deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6268
Published: 2025-06-19
Description: A vulnerability classified as problematic has been found in Luna Imaging up to 7.5.5.6. Affected is an unknown function of the file /luna/servlet/view/search. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.313272; https://vuldb.com/?id.313272; https://vuldb.com/?submit.592218
CVE: CVE-2006-2192
Published: 2025-06-19
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-52464
Published: 2025-06-19
Description: Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize the internal randomness pool on some platforms, leading to possible low-entropy key generation. When users with an affected key pair sent Direct Messages, those message could be captured and decrypted by an attacker that has compiled the list of compromised keys. This issue has been patched in version 2.6.11 where key generation is delayed til the first time the LoRa region is set, along with warning users when a compromised key is detected. Version 2.6.12 furthers this patch by automatically wiping known compromised keys when found. A workaround to this vulnerability involves users doing a complete device wipe to remove vendor-cloned keys.
CVSS Score: 8.3 (HIGH)
CWE: CWE-331
References: https://github.com/meshtastic/firmware/commit/4bf2dd04aeeccc4ba20c79bcaad7a572aabdecad; https://github.com/meshtastic/firmware/commit/55b2bbf93756fc7bbbfdbc7cbf29f88e6b637f22; https://github.com/meshtastic/firmware/commit/e5f6804421ac4b76dd31980250a505dba24c2aa6
CVE: CVE-2025-6269
Published: 2025-06-19
Description: A vulnerability classified as critical was found in HDF5 up to 1.14.6. Affected by this vulnerability is the function H5C__reconstruct_cache_entry of the file H5Cimage.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/HDFGroup/hdf5/issues/5579; https://github.com/user-attachments/files/20626503/reproduce.tar.gz; https://vuldb.com/?ctiid.313273
CVE: CVE-2025-50200
Published: 2025-06-19
Description: RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gh3x-4x42-fvq8
CVE: CVE-2025-6270
Published: 2025-06-19
Description: A vulnerability, which was classified as critical, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5FS__sect_find_node of the file H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/HDFGroup/hdf5/issues/5580; https://github.com/user-attachments/files/20626642/reproduce.tar.gz; https://vuldb.com/?ctiid.313274
CVE: CVE-2025-33117
Published: 2025-06-19
Description: IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12  could allow a privileged user to modify configuration files that would allow the upload of a malicious autoupdate file to execute arbitrary commands.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-73
References: https://www.ibm.com/support/pages/node/7237317
CVE: CVE-2025-33121
Published: 2025-06-19
Description: IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12  is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://www.ibm.com/support/pages/node/7237317
CVE: CVE-2025-36050
Published: 2025-06-19
Description: IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 stores potentially sensitive information in log files that could be read by a local user.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-532
References: https://www.ibm.com/support/pages/node/7237317
CVE: CVE-2025-6271
Published: 2025-06-19
Description: A vulnerability, which was classified as problematic, was found in swftools up to 0.9.2. This affects the function wav_convert2mono in the library lib/wav.c of the component wav2swf. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-125
References: https://github.com/swftools/swftools/issues/239; https://github.com/user-attachments/files/19415662/wav2swf_crash.txt; https://vuldb.com/?ctiid.313275
CVE: CVE-2025-6272
Published: 2025-06-19
Description: A vulnerability has been found in wasm3 0.5.0 and classified as problematic. This vulnerability affects the function MarkSlotAllocated of the file source/m3_compile.c. The manipulation leads to out-of-bounds write. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-787
References: https://github.com/user-attachments/files/19516600/wasm3_crash.txt; https://github.com/wasm3/wasm3/issues/531; https://vuldb.com/?ctiid.313276
CVE: CVE-2025-6273
Published: 2025-06-19
Description: A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect "real world wasm programs".
CVSS Score: 3.3 (LOW)
CWE: CWE-617
References: https://github.com/WebAssembly/wabt/issues/2574; https://github.com/user-attachments/files/19529411/wabt_crash.txt; https://vuldb.com/?ctiid.313277
CVE: CVE-2025-6274
Published: 2025-06-19
Description: A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.
CVSS Score: 3.3 (LOW)
CWE: CWE-400, CWE-404
References: https://github.com/WebAssembly/wabt/issues/2598; https://github.com/user-attachments/files/20191325/wabt_crash_4.txt; https://vuldb.com/?ctiid.313278
CVE: CVE-2025-6275
Published: 2025-06-19
Description: A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-416
References: https://github.com/WebAssembly/wabt/issues/2614; https://github.com/user-attachments/files/20623626/wabt_crash_5.txt; https://vuldb.com/?ctiid.313279
CVE: CVE-2025-6276
Published: 2025-06-19
Description: A vulnerability was found in Brilliance Golden Link Secondary System up to 20250609. It has been rated as critical. Affected by this issue is some unknown functionality of the file /storagework/rentTakeInfoPage.htm. The manipulation of the argument custTradeName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/eeeeeekkkkkkkk/POC/blob/main/%E9%BB%84%E9%87%91%E9%80%9A%E4%BA%8C%E7%BA%A7%E7%B3%BB%E7%BB%9F%E4%B8%89%E4%BB%A3%E7%AE%A1%E7%90%86%E7%AB%AF%E7%B3%BB%E7%BB%9FrentTakeInfoPage%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5.md; https://vuldb.com/?ctiid.313280; https://vuldb.com/?id.313280
CVE: CVE-2025-6277
Published: 2025-06-19
Description: A vulnerability classified as critical has been found in Brilliance Golden Link Secondary System up to 20250609. This affects an unknown part of the file /storagework/custTakeInfoPage.htm. The manipulation of the argument custTradeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/eeeeeekkkkkkkk/POC/blob/main/%E9%BB%84%E9%87%91%E9%80%9A%E4%BA%8C%E7%BA%A7%E7%B3%BB%E7%BB%9F%E4%B8%89%E4%BB%A3%E7%AE%A1%E7%90%86%E7%AB%AF%E7%B3%BB%E7%BB%9FcustTakeInfoPage%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5.md; https://vuldb.com/?ctiid.313281; https://vuldb.com/?id.313281
CVE: CVE-2025-6278
Published: 2025-06-19
Description: A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/Upsonic/Upsonic/issues/356; https://vuldb.com/?ctiid.313282; https://vuldb.com/?id.313282
CVE: CVE-2025-6279
Published: 2025-06-19
Description: A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/add_tool of the component Pickle Handler. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/Upsonic/Upsonic/issues/353; https://vuldb.com/?ctiid.313283; https://vuldb.com/?id.313283
CVE: CVE-2025-6384
Published: 2025-06-19
Description: Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution).

This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-913
References: https://docs.craftercms.org/current/security/advisory.html#cv[PII_REDACTED]
CVE: CVE-2025-47293
Published: 2025-06-19
Description: PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request forgery (SSRF) attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
CWE: CWE-611, CWE-918
References: https://github.com/powsybl/powsybl-core/commit/e6c7c4997ae8758b54a2f23ce1a499e25113acdc; https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2; https://github.com/powsybl/powsybl-core/security/advisories/GHSA-qpj9-qcwx-8jv2
CVE: CVE-2025-6280
Published: 2025-06-19
Description: A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_attachment of the file SuperAGI/superagi/helper/read_email.py of the component EmailToolKit. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/TransformerOptimus/SuperAGI/issues/1466; https://vuldb.com/?ctiid.313284; https://vuldb.com/?id.313284
CVE: CVE-2025-6281
Published: 2025-06-19
Description: A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /conv/community. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/OpenBMB/XAgent/issues/415; https://vuldb.com/?ctiid.313285; https://vuldb.com/?id.313285
CVE: CVE-2025-6282
Published: 2025-06-19
Description: A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/xlang-ai/OpenAgents/issues/141; https://vuldb.com/?ctiid.313286; https://vuldb.com/?id.313286
CVE: CVE-2025-6283
Published: 2025-06-19
Description: A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this issue. The patch is named 03f27055e0cf5d4fa7e874d34ce8c74c7b9086cc. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://github.com/xataio/agent/commit/03f27055e0cf5d4fa7e874d34ce8c74c7b9086cc; https://github.com/xataio/agent/issues/179; https://github.com/xataio/agent/pull/191
CVE: CVE-2025-6284
Published: 2025-06-19
Description: A vulnerability was found in PHPGurukul Car Rental Portal 3.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://medium.com/@kkfavas481/csrf-in-car-rental-portal-b202b3f2a4f6; https://phpgurukul.com/; https://vuldb.com/?ctiid.313288
CVE: CVE-2025-6285
Published: 2025-06-19
Description: A vulnerability was found in PHPGurukul COVID19 Testing Management System 2021. It has been rated as problematic. This issue affects some unknown processing of the file /search-report-result.php. The manipulation of the argument q leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.313289; https://vuldb.com/?id.313289
CVE: CVE-2025-6286
Published: 2025-06-19
Description: A vulnerability classified as problematic has been found in PHPGurukul COVID19 Testing Management System 2021. Affected is an unknown function of the file /search-report-result.php. The manipulation of the argument q leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.313290; https://vuldb.com/?id.313290
CVE: CVE-2025-47771
Published: 2025-06-20
Description: PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in an InputStream and returns a SparseMatrix object. This issue has been patched in com.powsybl:powsybl-math: 6.7.2. A workaround for this issue involves not using SparseMatrix deserialization (SparseMatrix.read(...) methods).
CWE: CWE-502
References: https://github.com/powsybl/powsybl-core/commit/8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd; https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2; https://github.com/powsybl/powsybl-core/security/advisories/GHSA-f5cx-h789-j959
CVE: CVE-2025-6287
Published: 2025-06-20
Description: A vulnerability classified as problematic was found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /test-details.php of the component Take Action. The manipulation of the argument remark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.313291; https://vuldb.com/?id.313291
CVE: CVE-2025-48058
Published: 2025-06-20
Description: PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl's DataSource mechanism. If successfully exploited, a malicious actor can cause significant CPU consumption due to regex backtracking — even with polynomial patterns. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
CWE: CWE-1333
References: https://github.com/powsybl/powsybl-core/commit/72f79dec6d4292f892fbddd68a19c67935c7d81f; https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2; https://github.com/powsybl/powsybl-core/security/advisories/GHSA-rqpx-f6rc-7hm5
CVE: CVE-2025-49715
Published: 2025-06-20
Description: Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49715
CVE: CVE-2025-6288
Published: 2025-06-20
Description: A vulnerability, which was classified as problematic, has been found in PHPGurukul Bus Pass Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin-profile.php of the component Profile Page. The manipulation of the argument profile name leads to cross site scripting. The attack may be launched remotely.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.313292; https://vuldb.com/?id.313292
CVE: CVE-2025-6291
Published: 2025-06-20
Description: A vulnerability, which was classified as critical, was found in D-Link DIR-825 2.03. This affects the function do_file of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir825-dlink; https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir825-dlink#poc; https://vuldb.com/?ctiid.313293
CVE: CVE-2025-6292
Published: 2025-06-20
Description: A vulnerability has been found in D-Link DIR-825 2.03 and classified as critical. This vulnerability affects the function sub_4091AC of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir825-dlink-sub_4091AC; https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir825-dlink-sub_4091AC#poc; https://vuldb.com/?ctiid.313294
CVE: CVE-2025-6293
Published: 2025-06-20
Description: A vulnerability was found in code-projects Hostel Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /contact_manager.php. The manipulation of the argument student_roll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/1xxxgg/cve/issues/3; https://vuldb.com/?ctiid.313295
CVE: CVE-2025-6294
Published: 2025-06-20
Description: A vulnerability was found in code-projects Hostel Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /contact.php. The manipulation of the argument hostel_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/1xxxgg/cve/issues/2; https://vuldb.com/?ctiid.313296
CVE: CVE-2025-6295
Published: 2025-06-20
Description: A vulnerability was found in code-projects Hostel Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /allocated_rooms.php. The manipulation of the argument search_box leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/1xxxgg/cve/issues/1; https://vuldb.com/?ctiid.313297
CVE: CVE-2025-6296
Published: 2025-06-20
Description: A vulnerability was found in code-projects Hostel Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /empty_rooms.php. The manipulation of the argument search_box leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/y2xsec324/cve/issues/1; https://vuldb.com/?ctiid.313298