deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8182
Published: 2025-07-26
Description: A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as problematic. This vulnerability affects unknown code of the file /etc_ro/smb.conf of the component Samba. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-521
References: https://vuldb.com/?ctiid.317596; https://vuldb.com/?id.317596; https://vuldb.com/?submit.621977
CVE: CVE-2025-8184
Published: 2025-07-26
Description: A vulnerability was found in D-Link DIR-513 up to 1.10 and classified as critical. This issue affects the function formSetWanL2TPcallback of the file /goform/formSetWanL2TPtriggers of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formSetWanPPTP.md; https://vuldb.com/?ctiid.317597; https://vuldb.com/?id.317597
CVE: CVE-2025-8185
Published: 2025-07-26
Description: A vulnerability was found in 1000 Projects ABC Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /getbyid.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/XiaoJiesecqwq/CVE/issues/1; https://vuldb.com/?ctiid.317598
CVE: CVE-2025-8186
Published: 2025-07-26
Description: A vulnerability was found in Campcodes Courier Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /edit_branch.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/XiaoJiesecqwq/CVE/issues/7; https://vuldb.com/?ctiid.317599; https://vuldb.com/?id.317599
CVE: CVE-2025-8187
Published: 2025-07-26
Description: A vulnerability was found in Campcodes Courier Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /edit_parcel.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/XiaoJiesecqwq/CVE/issues/8; https://vuldb.com/?ctiid.317600; https://vuldb.com/?id.317600
CVE: CVE-2025-8188
Published: 2025-07-26
Description: A vulnerability classified as critical has been found in Campcodes Courier Management System 1.0. This affects an unknown part of the file /edit_staff.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/XiaoJiesecqwq/CVE/issues/9; https://vuldb.com/?ctiid.317601; https://vuldb.com/?id.317601
CVE: CVE-2025-8189
Published: 2025-07-26
Description: A vulnerability classified as critical was found in Campcodes Courier Management System 1.0. This vulnerability affects unknown code of the file /edit_user.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/XiaoJiesecqwq/CVE/issues/10; https://vuldb.com/?ctiid.317602; https://vuldb.com/?id.317602
CVE: CVE-2025-8190
Published: 2025-07-26
Description: A vulnerability, which was classified as critical, has been found in Campcodes Courier Management System 1.0. This issue affects some unknown processing of the file /print_pdets.php. The manipulation of the argument ids leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/XiaoJiesecqwq/CVE/issues/11; https://vuldb.com/?ctiid.317603; https://vuldb.com/?id.317603
CVE: CVE-2025-8191
Published: 2025-07-26
Description: A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/macrozheng/mall/issues/919; https://github.com/zast-ai/vulnerability-reports/blob/main/mall/DOM_XSS.md; https://vuldb.com/?ctiid.317604
CVE: CVE-2025-8203
Published: 2025-07-26
Description: A vulnerability classified as critical has been found in Jingmen Zeyou Large File Upload Control up to 6.3. Affected is an unknown function of the file /index.jsp. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/William-xin/CVEs/issues/4; https://vuldb.com/?ctiid.317772; https://vuldb.com/?id.317772
CVE: CVE-2025-8204
Published: 2025-07-26
Description: A vulnerability classified as problematic was found in Comodo Dragon up to 134.0.6998.179. Affected by this vulnerability is an unknown functionality of the component HSTS Handler. The manipulation leads to security check for standard. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-358
References: https://news.fmisec.com/comodo-dragon-vulnerability; https://vuldb.com/?ctiid.317773; https://vuldb.com/?id.317773
CVE: CVE-2025-8205
Published: 2025-07-26
Description: A vulnerability, which was classified as problematic, has been found in Comodo Dragon up to 134.0.6998.179. Affected by this issue is some unknown functionality of the component IP DNS Leakage Detector. The manipulation leads to cleartext transmission of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-310, CWE-319, CWE-319
References: https://news.fmisec.com/comodo-dragon-vulnerability; https://vuldb.com/?ctiid.317774; https://vuldb.com/?id.317774
CVE: CVE-2025-8206
Published: 2025-07-26
Description: A vulnerability, which was classified as problematic, was found in Comodo Dragon up to 134.0.6998.179. This affects an unknown part of the component IP DNS Leakage Detector. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://news.fmisec.com/comodo-dragon-vulnerability; https://vuldb.com/?ctiid.317775; https://vuldb.com/?id.317775
CVE: CVE-2025-8207
Published: 2025-07-26
Description: A vulnerability was found in Canara ai1 Mobile Banking App 3.6.23 on Android and classified as problematic. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.canarabank.mobility. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.canarabank.mobility.md; https://vuldb.com/?ctiid.317777; https://vuldb.com/?id.317777
CVE: CVE-2025-8210
Published: 2025-07-26
Description: A vulnerability was found in Yeelink Yeelight App up to 3.5.4 on Android. It has been classified as problematic. Affected is an unknown function of the file AndroidManifest.xml of the component com.yeelight.cherry. The manipulation leads to improper export of android application components. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.yeelight.cherry.md; https://vuldb.com/?ctiid.317778; https://vuldb.com/?id.317778
CVE: CVE-2025-8211
Published: 2025-07-26
Description: A vulnerability was found in Roothub up to 2.6. It has been declared as problematic. Affected by this vulnerability is the function Edit of the file src/main/java/cn/roothub/web/admin/SystemConfigAdminController.java. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/wandeorfu/test; https://vuldb.com/?ctiid.317779; https://vuldb.com/?id.317779
CVE: CVE-2025-6241
Published: 2025-07-27
Description: LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default installation. If a user-writable directory is present in the SYSTEM PATH environment variable, the user can write a malicious DLL to that directory with arbitrary code. This malicious DLL is executed in the context of NT AUTHORITY\SYSTEM upon service start or restart, due to the Windows default dynamic-link library search order, resulting in local elevation of privileges.
CVSS Score: 4.4 (MEDIUM)
References: https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/10_10_0%20Hotfix%20Agent%20Release%20Notes%20On%20Premises.htm?tocpath=Release%20Notes%7CAgent%7C_____13; https://www.kb.cert.org/vuls/id/335798
CVE: CVE-2025-54597
Published: 2025-07-27
Description: LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://github.com/linuxserver/Heimdall/commit/d1a96dd752ba30dc56380400dd2587d8abb8e9d1; https://github.com/linuxserver/Heimdall/compare/v2.7.2...v2.7.3
CVE: CVE-2025-8219
Published: 2025-07-27
Description: A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. It has been rated as critical. This issue affects some unknown processing of the file /crm/crmapi/erp/tabdetail_moduleSave_dxkp.php of the component HTTP POST Request Handler. The manipulation of the argument getvaluestring leads to sql injection. The attack may be initiated remotely. Upgrading to version 8.6.5.2 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+. We strongly advise all customers to upgrade to the current version (v8.6.5.2), which includes this fix and additional security enhancements."
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.317807; https://vuldb.com/?id.317807; https://vuldb.com/?submit.616140
CVE: CVE-2025-8220
Published: 2025-07-27
Description: A vulnerability has been found in Engeman Web up to 12.0.0.2. The affected element is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox as part of Cookie leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 12.0.0.3 is sufficient to fix this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/m3m0o/engeman-web-language-combobox-sqli; https://vuldb.com/?ctiid.317808; https://vuldb.com/?id.317808
CVE: CVE-2025-8104
Published: 2025-07-27
Description: The Memory Usage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.98. This is due to missing nonce validation in the wpmemory_install_plugin() function. This makes it possible for unauthenticated attackers to silently install one of the several whitelisted plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wp-memory/tags/3.98/wpmemory.php#L376; https://plugins.trac.wordpress.org/changeset/3333316; https://wordpress.org/plugins/wp-memory/#developers
CVE: CVE-2025-8221
Published: 2025-07-27
Description: A vulnerability classified as problematic was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this vulnerability is the function goodsSearch of the file GoodsCustController.java. The manipulation of the argument keyword leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Bemcliu/cve-reports/blob/main/cve-04-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Reflected%20XSS/readme.md; https://vuldb.com/?ctiid.317809; https://vuldb.com/?id.317809
CVE: CVE-2025-8222
Published: 2025-07-27
Description: A vulnerability, which was classified as problematic, has been found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this issue is some unknown functionality of the file GoodsController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Multiple endpoints are affected.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Bemcliu/cve-reports/blob/main/cve-05-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Stored%20XSS/readme.md; https://vuldb.com/?ctiid.317810; https://vuldb.com/?id.317810
CVE: CVE-2025-8223
Published: 2025-07-27
Description: A vulnerability, which was classified as problematic, was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. This affects an unknown part of the file AdminTypeCustController.java. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://github.com/Bemcliu/cve-reports/blob/main/cve-06-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-CSRF/readme.md; https://vuldb.com/?ctiid.317811; https://vuldb.com/?id.317811
CVE: CVE-2025-8224
Published: 2025-07-27
Description: A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is db856d41004301b3a56438efd957ef5cabb91530. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476, CWE-476
References: https://sourceware.org/bugzilla/attachment.cgi?id=15680; https://sourceware.org/bugzilla/show_bug.cgi?id=32109; https://sourceware.org/bugzilla/show_bug.cgi?id=32109#c2
CVE: CVE-2025-5120
Published: 2025-07-27
Description: A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability stems from the local_python_executor.py module, which inadequately restricts Python code execution despite employing static and dynamic checks. Attackers can exploit whitelisted modules and functions to execute arbitrary code, compromising the host system. This flaw undermines the core security boundary intended to isolate untrusted code, posing risks such as unauthorized code execution, data leakage, and potential integration-level compromise. The issue is resolved in version 1.17.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://github.com/huggingface/smolagents/commit/33a942e62b6fbf6a35d41f1c735bda2d64c163d0; https://huntr.com/bounties/63ab1cfe-b573-4cf5-a7d3-fb6c957e34b0
CVE: CVE-2025-8225
Published: 2025-07-27
Description: A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c of the component DWARF Section Handler. The manipulation leads to memory leak. Attacking locally is a requirement. The identifier of the patch is e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-401, CWE-404, CWE-401
References: https://gitlab.com/gnutools/binutils-gdb/-/commit/e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4; https://vuldb.com/?ctiid.317813; https://vuldb.com/?id.317813
CVE: CVE-2025-8226
Published: 2025-07-27
Description: A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been classified as problematic. Affected is an unknown function of the file /sysApp/find. The manipulation of the argument accessKey/secretKey leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP9V; https://vuldb.com/?ctiid.317814; https://vuldb.com/?id.317814
CVE: CVE-2025-8227
Published: 2025-07-27
Description: A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /collect/getArticle. The manipulation of the argument taskUrl leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The patch is named 33d9bb464353015aaaba84e27638ac9a3912795d. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://gitee.com/yanyutao0402/ChanCMS/commit/33d9bb464353015aaaba84e27638ac9a3912795d; https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP81; https://gitee.com/yanyutao0402/ChanCMS/tree/V3.1.3
CVE: CVE-2025-8228
Published: 2025-07-27
Description: A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been rated as critical. Affected by this issue is the function getPages of the file /cms/collect/getPages. The manipulation of the argument targetUrl leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP28; https://gitee.com/yanyutao0402/ChanCMS/releases/tag/V3.1.3; https://vuldb.com/?ctiid.317816
CVE: CVE-2025-8229
Published: 2025-07-27
Description: A vulnerability classified as critical has been found in Campcodes Courier Management System 1.0. This affects an unknown part of the file /parcel_list.php. The manipulation of the argument s leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/XiaoJiesecqwq/CVE/issues/13; https://vuldb.com/?ctiid.317817; https://vuldb.com/?id.317817
CVE: CVE-2025-8230
Published: 2025-07-27
Description: A vulnerability classified as critical was found in Campcodes Courier Management System 1.0. This vulnerability affects unknown code of the file /manage_user.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/XiaoJiesecqwq/CVE/issues/14; https://vuldb.com/?ctiid.317818; https://vuldb.com/?id.317818
CVE: CVE-2025-8231
Published: 2025-07-27
Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-890L up to 111b04. This issue affects some unknown processing of the file rgbin of the component UART Port. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-259, CWE-798, CWE-798
References: https://github.com/Nicholas-wei/bug-discovery/blob/main/dlink/dir890-hardcoded/dir890-hardcoded.md; https://vuldb.com/?ctiid.317819; https://vuldb.com/?id.317819
CVE: CVE-2025-8232
Published: 2025-07-27
Description: A vulnerability, which was classified as critical, was found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/delete_user.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiajian-qx/cve-xiajian/issues/7; https://vuldb.com/?ctiid.317820
CVE: CVE-2025-8233
Published: 2025-07-27
Description: A vulnerability has been found in code-projects Online Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/user.php. The manipulation of the argument un leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiajian-qx/cve-xiajian/issues/6; https://vuldb.com/?ctiid.317821