deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-49581
Published: 2025-06-13
Description: XWiki is a generic wiki platform. Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming right by defining a wiki macro. This allows full access to the whole XWiki installation. The main problem is that if a wiki macro parameter allows wiki syntax, its default value is executed with the rights of the author of the document where it is used. This can be exploited by overriding a macro like the children macro that is used in a page that has programming right like the page XWiki.ChildrenMacro and thus allows arbitrary script macros. This vulnerability has been patched in XWiki 16.4.7, 16.10.3 and 17.0.0 by executing wiki parameters with the rights of the wiki macro's author when the parameter's value is the default value.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-250, CWE-270
References: https://github.com/xwiki/xwiki-platform/commit/c99d501ed41cbee6a3c02ff[PII_REDACTED]70789de; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9875-cw22-f7cx; https://jira.xwiki.org/browse/XWIKI-22760
CVE: CVE-2025-6035
Published: 2025-06-13
Description: A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle"  plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue could lead to heap corruption, a potential denial of service (DoS), or arbitrary code execution in certain scenarios.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://access.redhat.com/security/cve/CVE-2025-6035; https://bugzilla.redhat.com/show_bug.cgi?id=2372515; https://gitlab.gnome.org/GNOME/gimp/-/issues/13518
CVE: CVE-2025-6052
Published: 2025-06-13
Description: A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.
CVSS Score: 3.7 (LOW)
CWE: CWE-190
References: https://access.redhat.com/security/cve/CVE-2025-6052; https://bugzilla.redhat.com/show_bug.cgi?id=2372666
CVE: CVE-2025-49582
Published: 2025-06-13
Description: XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution. The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.
CVSS Score: 8.0 (HIGH)
CWE: CWE-357
References: https://github.com/xwiki/xwiki-platform/commit/0a705e8e253cb871b804e25c53b2bde879c886bd; https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c; https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8
CVE: CVE-2025-49583
Published: 2025-06-13
Description: XWiki is a generic wiki platform. When a user without script right creates a document with an `XWiki.Notifications.Code.NotificationEmailRendererClass` object, and later an admin edits and saves that document, the email templates in this object will be used for notifications. No malicious code can be executed, though, as while these templates allow Velocity code, the existing generic analyzer already warns admins before editing Velocity code. The main impact would thus be to send spam, e.g., with phishing links to other users or to hide notifications about other attacks. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This has been patched in XWiki 16.10.2, 16.4.7 and 15.10.16 by adding an analysis for the respective XClass properties.
CVSS Score: 3.5 (LOW)
CWE: CWE-270, CWE-357
References: https://github.com/xwiki/xwiki-platform/commit/3d96bf3ceb167bf0213d63f0be1f7e1732eb0a92; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ff6v-w58f-v97w; https://jira.xwiki.org/browse/XWIKI-22471
CVE: CVE-2025-49584
Published: 2025-06-13
Description: XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page whose reference is known can be accessed through the REST API as long as an XClass with a page property is accessible, this is the default for an XWiki installation. This allows an attacker to get titles of pages whose reference is known, one title per request. This doesn't affect fully private wikis as the REST endpoint checks access rights on the XClass definition. The impact on confidentiality depends on the strategy for page names. By default, page names match the title, so the impact should be low but if page names are intentionally obfuscated because the titles are sensitive, the impact could be high. This has been fixed in XWiki 16.4.7, 16.10.3 and 17.0.0 by adding access control checks before getting the title of any page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201
References: https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvp5-qx9c-c3fv; https://jira.xwiki.org/browse/XWIKI-22736
CVE: CVE-2025-49585
Published: 2025-06-13
Description: XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki (requires edit right), and that same document is later edited by a user with script, admin, or programming right, malicious code could be executed with the rights of the editing user without prior warning. In particular, this concerns custom display code, the script of computed properties and queries in database list properties. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This has been patched in XWiki 16.10.2, 16.4.7 and 15.10.16 by adding an analysis for the respective XClass properties.
CVSS Score: 8.0 (HIGH)
CWE: CWE-357
References: https://github.com/xwiki/xwiki-platform/commit/385bde985cdb61ebf315d30c0b144b6d2e2c2d45; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-59w6-r9hm-439h; https://jira.xwiki.org/browse/XWIKI-22476
CVE: CVE-2025-49586
Published: 2025-06-13
Description: XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp4x-w9cj-97q7; https://jira.xwiki.org/browse/XWIKI-22719
CVE: CVE-2025-49587
Published: 2025-06-13
Description: XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification displayer executes Velocity, the existing generic analyzer already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This vulnerability has been patched in XWiki 15.10.16, 16.4.7, and 16.10.2 by adding a required rights analyzer that warns the admin before editing about the possibly malicious code.
CVSS Score: 8.0 (HIGH)
CWE: CWE-357
References: https://github.com/xwiki/xwiki-platform/commit/55c5d568c4dc4619f37397d00d14dcdeab9c252d; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j7p2-87q3-44w7; https://jira.xwiki.org/browse/XWIKI-22470
CVE: CVE-2025-49596
Published: 2025-06-13
Description: The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
CWE: CWE-306
References: https://github.com/modelcontextprotocol/inspector/commit/50df0e1ec488f3983740b4d28d2a968f12eb8979; https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g; https://thenewstack.io/mcp-vulnerability-exposes-the-ai-untrusted-code-crisis
CVE: CVE-2025-49597
Published: 2025-06-13
Description: handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.
CVSS Score: 3.9 (LOW)
CWE: CWE-915
References: https://github.com/handcraftedinthealps/goodby-csv/commit/acd14c6ed85116bb2cb4da35ab62821e5cf54519; https://github.com/handcraftedinthealps/goodby-csv/security/advisories/GHSA-x3c7-22c8-prg7
CVE: CVE-2025-24311
Published: 2025-06-13
Description: An out-of-bounds read vulnerability exists in the cv_send_blockdata 
functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted 
ControlVault API call can lead to an information leak. An attacker can 
issue an API call to trigger this vulnerability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-125
References: https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2127
CVE: CVE-2025-24922
Published: 2025-06-13
Description: A stack-based buffer overflow vulnerability exists in the 
securebio_identify functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A 
specially crafted malicious cv_object can lead to a arbitrary code 
execution. An attacker can issue an API call to trigger this 
vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2130
CVE: CVE-2025-25050
Published: 2025-06-13
Description: An out-of-bounds write vulnerability exists in the 
cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3 Plus prior to 6.2.26.36.
 A specially crafted ControlVault API call can lead to an out-of-bounds 
write. An attacker can issue an API call to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2137
CVE: CVE-2025-49598
Published: 2025-06-13
Description: conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling meta.yaml can inject malicious code into the version assignment, which is executed during file processing, leading to arbitrary code execution. Exploitation requires an attacker to modify the recipe file by manipulating the RECIPE_DIR variable and introducing a malicious meta.yaml file. While this is more feasible in CI/CD pipelines, it is uncommon in typical environments, reducing overall risk. This vulnerability is fixed in 4.15.0.
CWE: CWE-95
References: https://github.com/conda-forge/conda-forge-ci-setup-feedstock/commit/fd91cb271c01f0e7928ebdc1feaac96fe385f959; https://github.com/conda-forge/conda-forge-ci-setup-feedstock/security/advisories/GHSA-jh2q-mrmj-hff3; https://github.com/conda-forge/conda-forge-ci-setup-feedstock/security/advisories/GHSA-jh2q-mrmj-hff3
CVE: CVE-2025-6083
Published: 2025-06-13
Description: In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specific owner_id.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://extreme-networks.my.site.com/ExtrArticleDetail?an=000126912
CVE: CVE-2025-24919
Published: 2025-06-13
Description: A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2153
CVE: CVE-2025-25215
Published: 2025-06-13
Description: An arbitrary free vulnerability exists in the cv_close functionality of 
Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call 
can lead to an arbitrary free. An attacker can forge a fake session to 
trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-763
References: https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2129
CVE: CVE-2025-33108
Published: 2025-06-14
Description: IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program.   A malicious actor could cause user-controlled code to run with component access to the host operating system.
CVSS Score: 8.5 (HIGH)
CWE: CWE-250
References: https://www.ibm.com/support/pages/node/7236663
CVE: CVE-2025-6059
Published: 2025-06-14
Description: The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/main.php#L2259; https://plugins.trac.wordpress.org/changeset/3284098/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f711c9d0-aa56-4e4c-bbcf-afa9598c3518?source=cve
CVE: CVE-2025-3234
Published: 2025-06-14
Description: The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.8.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Administrators have the ability to extend file manager usage privileges to lower-level users including subscribers, which would make this vulnerability more severe on such sites.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3310066%40filester%2Ftrunk&old=3294389%40filester%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/00df02cd-b4d3-477a-86ee-aa2f9b5216e8?source=cve
CVE: CVE-2025-5487
Published: 2025-06-14
Description: The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the field_conditions parameter in all versions up to, and including, 5.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Administrators can configure the plugin to allow access to this functionality to authors and higher.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/automatorwp/tags/5.2.3/integrations/automatorwp/triggers/all-posts.php#L256; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3307465%40automatorwp%2Ftrunk&old=3302138%40automatorwp%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1a84c6-e28b-42fe-a16a-aeb227cfe956?source=cve
CVE: CVE-2025-4187
Published: 2025-06-14
Description: The UserPro - Community and User Profile WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.10 via the userpro_fbconnect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681; https://www.wordfence.com/threat-intel/vulnerabilities/id/2745a40c-b011-4fe5-b2f7-d97ee6972568?source=cve
CVE: CVE-2025-4200
Published: 2025-06-14
Description: The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the load_view() function that is called via at least three AJAX actions: 'load_more_post', 'load_shop', and 'load_more_product. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://themeforest.net/item/zagg-electronics-accessories-woocommerce-wordpress-theme/54636595; https://www.wordfence.com/threat-intel/vulnerabilities/id/327deb08-715f-4d54-b95b-18552c07cbc0?source=cve
CVE: CVE-2025-4216
Published: 2025-06-14
Description: The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and including, 1.0.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ecava-diot-scada/trunk/includes/shortcodes.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf23d79-5bd3-4224-835d-174653ddd504?source=cve
CVE: CVE-2025-4592
Published: 2025-06-14
Description: The AI Image Lab – Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/ai-image-generator-lab/trunk/includes/admin/admin-page.php#L3; https://www.wordfence.com/threat-intel/vulnerabilities/id/61d56713-59af-4ad9-8744-6c6a5e5fe213?source=cve
CVE: CVE-2025-5336
Published: 2025-06-14
Description: The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-no_number’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.22/new/inc/assets/js/dev/app.dev.js#L126; https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.22/new/inc/assets/js/dev/app.dev.js#L818; https://plugins.trac.wordpress.org/changeset/3309693/
CVE: CVE-2025-5589
Published: 2025-06-14
Description: The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘status-classic-offline-text’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/streamweasels-kick-integration/trunk/public/partials/streamweasels-kick-status-public-display.php#L50; https://plugins.trac.wordpress.org/changeset/3309930/streamweasels-kick-integration/trunk/public/partials/streamweasels-kick-status-public-display.php; https://wordpress.org/plugins/streamweasels-kick-integration/#developers
CVE: CVE-2025-6040
Published: 2025-06-14
Description: The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'ef_settings_submenu' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/easy-flashcards/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff97ee8-9732-4d26-b5e8-b744730e9c5a?source=cve