deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11692
Published: 2025-10-15
Description: The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the current wp_upload_dir directory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/zip-attachments/tags/1.6/download.php#L27; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8d746f-82e2-4615-92bb-35d20124dc56?source=cve
CVE: CVE-2025-11701
Published: 2025-10-15
Description: The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to download attachments from private and password-protected posts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: http://plugins.trac.wordpress.org/browser/zip-attachments/tags/1.6/zip-attachments.php#L46; http://plugins.trac.wordpress.org/browser/zip-attachments/tags/1.6/zip-attachments.php#L95; https://www.wordfence.com/threat-intel/vulnerabilities/id/e166d52d-73d1-4572-b9cc-ab935b05e13c?source=cve
CVE: CVE-2025-11722
Published: 2025-10-15
Description: The Woocommerce Category and Products Accordion Panel plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'categoryaccordionpanel' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/accordion-panel-for-category-and-products/tags/1.0/include/abstract.php#L256; https://plugins.trac.wordpress.org/browser/accordion-panel-for-category-and-products/tags/1.0/include/categoryaccordionpanel.php#L87; https://www.wordfence.com/threat-intel/vulnerabilities/id/55315ba1-cbb8-4ce1-96c6-30a02611ba47?source=cve
CVE: CVE-2025-11728
Published: 2025-10-15
Description: The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in all versions up to, and including, 6.0. This makes it possible for unauthenticated attackers to update WooCommerce orders to 'failed' status, and update transaction IDs.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://plugins.trac.wordpress.org/browser/oceanpayment-creditcard-gateway/trunk/class-wc-oceancreditcard.php#L489; https://plugins.trac.wordpress.org/browser/oceanpayment-creditcard-gateway/trunk/class-wc-oceancreditcard.php#L594; https://www.wordfence.com/threat-intel/vulnerabilities/id/c560bc33-d664-433e-bfd9-e4fa1776bb76?source=cve
CVE: CVE-2025-9967
Published: 2025-10-15
Description: The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/orion-sms-otp-verification/trunk/vendor/js/reset-password.js; https://plugins.trac.wordpress.org/log/orion-sms-otp-verification/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b121fdb4-93a8-400c-89c2-3195cb40e03c?source=cve
CVE: CVE-2025-55081
Published: 2025-10-15
Description: In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of 
certain SSL/TLS client hello message: the ciphersuite length and 
compression method length. In case of an attacker-crafted message with 
values outside of the expected range, it could cause an out-of-bound 
read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-126, CWE-125
References: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-5vrv-8j5h-h6h6
CVE: CVE-2025-55082
Published: 2025-10-15
Description: In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was a potential out of bound read in _nx_secure_tls_process_clienthello() because of a missing validation of PSK length provided in the user message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-8h38-qjhh-mf2h
CVE: CVE-2025-10869
Published: 2025-10-15
Description: Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript that is sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Data/SaveInteractions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-oct8ne-chatbot
CVE: CVE-2025-9640
Published: 2025-10-15
Description: A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://access.redhat.com/security/cve/CVE-2025-9640; https://bugzilla.redhat.com/show_bug.cgi?id=2391698; https://www.samba.org/samba/history/security.html
CVE: CVE-2025-41430
Published: 2025-10-15
Description: When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://my.f5.com/manage/s/article/K000150667
CVE: CVE-2025-46706
Published: 2025-10-15
Description: When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://my.f5.com/manage/s/article/K000151611
CVE: CVE-2025-47148
Published: 2025-10-15
Description: When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://my.f5.com/manage/s/article/K000148816
CVE: CVE-2025-47150
Published: 2025-10-15
Description: When SNMP is configured on F5OS Appliance and Chassis systems, undisclosed requests can cause an increase in SNMP memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://my.f5.com/manage/s/article/K000149820
CVE: CVE-2025-48008
Published: 2025-10-15
Description: When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://my.f5.com/manage/s/article/K000150614
CVE: CVE-2025-53474
Published: 2025-10-15
Description: When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://my.f5.com/manage/s/article/K44517780
CVE: CVE-2025-53521
Published: 2025-10-15
Description: When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://my.f5.com/manage/s/article/K000156741; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521
CVE: CVE-2025-53856
Published: 2025-10-15
Description: When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  To determine which BIG-IP platforms have an ePVA chip refer to  K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 .  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-705
References: https://my.f5.com/manage/s/article/K000156707
CVE: CVE-2025-53868
Published: 2025-10-15
Description: When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.7 (HIGH)
CWE: CWE-78
References: https://my.f5.com/manage/s/article/K000151902
CVE: CVE-2025-54479
Published: 2025-10-15
Description: When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://my.f5.com/manage/s/article/K000151475
CVE: CVE-2025-54755
Published: 2025-10-15
Description: A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://my.f5.com/manage/s/article/K000156801
CVE: CVE-2025-54805
Published: 2025-10-15
Description: When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can cause an increase in the Traffic Management Microkernel (TMM) memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://my.f5.com/manage/s/article/K000151596
CVE: CVE-2025-54854
Published: 2025-10-15
Description: When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://my.f5.com/manage/s/article/K000156602
CVE: CVE-2025-54858
Published: 2025-10-15
Description: When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://my.f5.com/manage/s/article/K000156621
CVE: CVE-2025-55036
Published: 2025-10-15
Description: When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://my.f5.com/manage/s/article/K000151368
CVE: CVE-2025-55669
Published: 2025-10-15
Description: When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-672, CWE-672
References: https://my.f5.com/manage/s/article/K000150752
CVE: CVE-2025-55670
Published: 2025-10-15
Description: On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes systems, repeated undisclosed API calls can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://my.f5.com/manage/s/article/K000154614
CVE: CVE-2025-56746
Published: 2025-10-15
Description: Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.
CVSS Score: 2.2 (LOW)
CWE: CWE-384
References: https://suryadina.com/academy-lms-session-fixation-1t8v5n3q6h/
CVE: CVE-2025-58096
Published: 2025-10-15
Description: When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://my.f5.com/manage/s/article/K000156691
CVE: CVE-2025-58120
Published: 2025-10-15
Description: When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://my.f5.com/manage/s/article/K000156623
CVE: CVE-2025-58153
Published: 2025-10-15
Description: Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge (HSB) may experience a lockup of the HSB.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://my.f5.com/manage/s/article/K000151658
CVE: CVE-2025-58424
Published: 2025-10-15
Description: On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity protection.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-340
References: https://my.f5.com/manage/s/article/K000151297
CVE: CVE-2025-58474
Published: 2025-10-15
Description: When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://my.f5.com/manage/s/article/K000148512
CVE: CVE-2025-59268
Published: 2025-10-15
Description: On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attacker through the Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://my.f5.com/manage/s/article/K90301300
CVE: CVE-2025-59269
Published: 2025-10-15
Description: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://my.f5.com/manage/s/article/K000151308
CVE: CVE-2025-59478
Published: 2025-10-15
Description: When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-824
References: https://my.f5.com/manage/s/article/K000152341
CVE: CVE-2025-59481
Published: 2025-10-15
Description: A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges.  A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.7 (HIGH)
CWE: CWE-250
References: https://my.f5.com/manage/s/article/K000156642
CVE: CVE-2025-59483
Published: 2025-10-15
Description: A validation vulnerability exists in an undisclosed URL in the Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://my.f5.com/manage/s/article/K000156800
CVE: CVE-2025-59778
Published: 2025-10-15
Description: When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://my.f5.com/manage/s/article/K000151718
CVE: CVE-2025-59781
Published: 2025-10-15
Description: When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: https://my.f5.com/manage/s/article/K000150637
CVE: CVE-2025-60013
Published: 2025-10-15
Description: When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module (HSM) may fail to initialize. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-78
References: https://my.f5.com/manage/s/article/K000154661
CVE: CVE-2025-60015
Published: 2025-10-15
Description: An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption. 

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-787
References: https://my.f5.com/manage/s/article/K000156796
CVE: CVE-2025-60016
Published: 2025-10-15
Description: When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher Group, and that profile is applied to a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://my.f5.com/manage/s/article/K000139514
CVE: CVE-2025-61938
Published: 2025-10-15
Description: When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repeatedly.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://my.f5.com/manage/s/article/K000156624
CVE: CVE-2025-61951
Published: 2025-10-15
Description: Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is enabled with a Server SSL profile that is configured with a certificate, key, and the SSL Sign Hash set to ANY, and the backend server is enabled with DTLS 1.2 and client authentication.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://my.f5.com/manage/s/article/K000151309
CVE: CVE-2025-61955
Published: 2025-10-15
Description: A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges.  A successful exploit may allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.8 (HIGH)
CWE: CWE-95
References: https://my.f5.com/manage/s/article/K000156771
CVE: CVE-2025-61958
Published: 2025-10-15
Description: A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell.  For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.7 (HIGH)
CWE: CWE-250
References: https://my.f5.com/manage/s/article/K000154647
CVE: CVE-2025-61960
Published: 2025-10-15
Description: When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://my.f5.com/manage/s/article/K000156597
CVE: CVE-2025-61974
Published: 2025-10-15
Description: When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://my.f5.com/manage/s/article/K000156733
CVE: CVE-2025-10581
Published: 2025-10-15
Description: A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a local authenticated user to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://iknow.lenovo.com.cn/detail/432378
CVE: CVE-2025-10699
Published: 2025-10-15
Description: A vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://iknow.lenovo.com.cn/detail/432379; https://lecloud.lenovo.com/index