deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8918
Published: 2025-08-13
Description: A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_instituicao_cad.php of the component Editar Page. The manipulation of the argument neighborhood name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/FeMarb/CVEs/blob/6eeefb2749bb6165557ed4664a[PII_REDACTED]e4de/i-educar/Cross-Site%20Scripting%20(XSS)%20Storage%20in%20endpoint%20_educar_instituicao_cad.php%20parameter%20neighborhood%20name.md; https://vuldb.com/?ctiid.319877; https://vuldb.com/?id.319877
CVE: CVE-2025-2180
Published: 2025-08-13
Description: An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma® Cloud.

This issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415.
CWE: CWE-502
References: https://security.paloaltonetworks.com/CVE-2025-2180
CVE: CVE-2025-2181
Published: 2025-08-13
Description: A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access keys in Checkov's output.
CWE: CWE-312
References: https://security.paloaltonetworks.com/CVE-2025-2181
CVE: CVE-2025-2182
Published: 2025-08-13
Description: A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster.
A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.
CWE: CWE-312
References: https://security.paloaltonetworks.com/CVE-2025-2182
CVE: CVE-2025-2183
Published: 2025-08-13
Description: An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.
CWE: CWE-295
References: https://security.paloaltonetworks.com/CVE-2025-2183
CVE: CVE-2025-2184
Published: 2025-08-13
Description: A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations.

The attacker must have network access to the Broker VM to exploit this issue.
CWE: CWE-1392
References: https://security.paloaltonetworks.com/CVE-2025-2184
CVE: CVE-2025-34153
Published: 2025-08-13
Description: Hyland OnBase versions prior to 17.0.2.87 (other versions may be affected) are vulnerable to unauthenticated remote code execution via insecure deserialization on the .NET Remoting TCP channel. The service registers a listener on port 6031 with the URI endpoint TimerServer, implemented in Hyland.Core.Timers.dll. This endpoint deserializes untrusted input using the .NET BinaryFormatter, allowing attackers to execute arbitrary code under the context of NT AUTHORITY\SYSTEM.
CWE: CWE-502
References: https://community.hyland.com/resources/bulletins-and-notices/210540-security-update-hyland-timer-service-bulletin-ob2025-02; https://gist.github.com/VAMorales/32794cccc2195a935623a12ef32760dc; https://support.hyland.com/r/OnBase/WorkView/Foundation-24.1/WorkView/Installation/Upgrade-Considerations/Upgrading-to-OnBase-Version-Foundation-24.1
CVE: CVE-2025-50594
Published: 2025-08-13
Description: An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://www.aecyberpro.com/blog/general/2025-04-30-Account-Takeover-BOLA-Hospital-Management-System-EMR/
CVE: CVE-2025-51451
Published: 2025-08-13
Description: In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://n200re.com; https://gist.github.com/lin-3-start/e42344d5caea881e5429fdd40fad1fd8; https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/204/ids/36.html
CVE: CVE-2025-52385
Published: 2025-08-13
Description: An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process module
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://cwe.mitre.org/data/definitions/78.html; https://cwe.mitre.org/data/definitions/94.html; https://github.com/Kov404/CVE-2025-52385/tree/main
CVE: CVE-2024-10219
Published: 2025-08-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/500134; https://hackerone.com/reports/2780353
CVE: CVE-2024-12303
Published: 2025-08-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users with specific roles and permissions to delete issues including confidential ones by inviting users with a specific role.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-266
References: https://gitlab.com/gitlab-org/gitlab/-/issues/508298; https://hackerone.com/reports/2861889
CVE: CVE-2024-5477
Published: 2025-08-13
Description: A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, arbitrary code execution, denial of service, or information disclosure via a physical attack that requires specialized equipment and knowledge.  HP is releasing firmware mitigation for the potential vulnerability.
CWE: CWE-1256
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]8471-16/hpsbhf04043
CVE: CVE-2025-1477
Published: 2025-08-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an unauthenticated user to create a denial of service condition by sending specially crafted payloads to specific integration API endpoints.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/520353; https://hackerone.com/reports/2987614
CVE: CVE-2025-23294
Published: 2025-08-13
Description: NVIDIA WebDataset for all platforms contains a vulnerability where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23294; https://nvidia.custhelp.com/app/answers/detail/a_id/5658; https://www.cve.org/CVERecord?id=CVE-2025-23294
CVE: CVE-2025-23295
Published: 2025-08-13
Description: NVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23295; https://nvidia.custhelp.com/app/answers/detail/a_id/5680; https://www.cve.org/CVERecord?id=CVE-2025-23295
CVE: CVE-2025-23296
Published: 2025-08-13
Description: NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23296; https://nvidia.custhelp.com/app/answers/detail/a_id/5681; https://www.cve.org/CVERecord?id=CVE-2025-23296
CVE: CVE-2025-23298
Published: 2025-08-13
Description: NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability in a python dependency, where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23298; https://nvidia.custhelp.com/app/answers/detail/a_id/5683; https://www.cve.org/CVERecord?id=CVE-2025-23298
CVE: CVE-2025-23303
Published: 2025-08-13
Description: NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23303; https://nvidia.custhelp.com/app/answers/detail/a_id/5686; https://www.cve.org/CVERecord?id=CVE-2025-23303
CVE: CVE-2025-23304
Published: 2025-08-13
Description: NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection by loading .nemo files with maliciously crafted metadata. A successful exploit of this vulnerability may lead to remote code execution and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23304; https://nvidia.custhelp.com/app/answers/detail/a_id/5686; https://www.cve.org/CVERecord?id=CVE-2025-23304
CVE: CVE-2025-23305
Published: 2025-08-13
Description: NVIDIA Megatron-LM for all platforms contains a vulnerability in the tools component, where an attacker may exploit a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23305; https://nvidia.custhelp.com/app/answers/detail/a_id/5685; https://www.cve.org/CVERecord?id=CVE-2025-23305
CVE: CVE-2025-23306
Published: 2025-08-13
Description: NVIDIA Megatron-LM for all platforms contains a vulnerability in the megatron/training/
arguments.py component where an attacker could cause a code injection issue by providing a malicious input. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23306; https://nvidia.custhelp.com/app/answers/detail/a_id/5685; https://www.cve.org/CVERecord?id=CVE-2025-23306
CVE: CVE-2025-2498
Published: 2025-08-13
Description: An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions.
CVSS Score: 3.1 (LOW)
CWE: CWE-1220
References: https://gitlab.com/gitlab-org/gitlab/-/issues/525515; https://hackerone.com/reports/3037722
CVE: CVE-2025-2614
Published: 2025-08-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/526349; https://hackerone.com/reports/3015894
CVE: CVE-2025-2937
Published: 2025-08-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333
References: https://gitlab.com/gitlab-org/gitlab/-/issues/528995; https://hackerone.com/reports/3058879
CVE: CVE-2025-45314
Published: 2025-08-13
Description: A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://hortusfox-web.com; https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-45314/CVE-2025-45314.md; https://github.com/danielbrendel/hortusfox-web
CVE: CVE-2025-45315
Published: 2025-08-13
Description: A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://hortusfox-web.com; https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-45315/CVE-2025-45315.md; https://github.com/danielbrendel/hortusfox-web
CVE: CVE-2025-45316
Published: 2025-08-13
Description: A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-45316/CVE-2025-45316.md; https://github.com/danielbrendel/hortusfox-web/blob/8ab851101a62d8eb311235c118eeeb32a9b36978/app/models/ChatMsgModel.php#L47; https://github.com/danielbrendel/hortusfox-web/blob/8ab851101a62d8eb311235c118eeeb32a9b36978/app/modules/TextBlockModule.php#L15
CVE: CVE-2025-45317
Published: 2025-08-13
Description: A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-45317/CVE-2025-45317.md; https://github.com/danielbrendel/hortusfox-web/blob/8ab851101a62d8eb311235c118eeeb32a9b36978/app/modules/ImportModule.php#L28
CVE: CVE-2025-50615
Published: 2025-08-13
Description: A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00470c50 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_mac_filter_set in the payload, which can cause the program to crash and lead to a Denial of Service (DoS) attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/Chinesexilinyu/Netis-WF2880-cgitest.cgi-Vulnerability/tree/main/8
CVE: CVE-2025-50616
Published: 2025-08-13
Description: A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046f984 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_advanced_set in the payload, which can cause the program to crash and lead to a Denial of Service (DoS) attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/Chinesexilinyu/Netis-WF2880-cgitest.cgi-Vulnerability/tree/main/9
CVE: CVE-2025-50617
Published: 2025-08-13
Description: A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wps_set in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://github.com/Chinesexilinyu/Netis-WF2880-cgitest.cgi-Vulnerability/tree/main/10
CVE: CVE-2025-50946
Published: 2025-08-13
Description: OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://github.com/OliveTin/OliveTin; https://github.com/OliveTin/OliveTin/blob/8c073bf45fca6c6eda4e8a9feb[PII_REDACTED]3ee/service/internal/executor/arguments.go#L211; https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-50946/CVE-2025-50946.md
CVE: CVE-2025-5819
Published: 2025-08-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-732
References: https://gitlab.com/gitlab-org/gitlab/-/issues/548165; https://hackerone.com/reports/3137660
CVE: CVE-2025-6186
Published: 2025-08-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/549844; https://hackerone.com/reports/3189522
CVE: CVE-2025-7734
Published: 2025-08-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/556090; https://hackerone.com/reports/3247096
CVE: CVE-2025-7739
Published: 2025-08-13
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/556111; https://hackerone.com/reports/3255849
CVE: CVE-2025-8754
Published: 2025-08-13
Description: Missing Authentication for Critical Function vulnerability in ABB ABB AbilityTM zenon.This issue affects ABB AbilityTM zenon: from 7.50 through 14.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://search.abb.com/library/Download.aspx?DocumentID=2NGA002743&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-8770
Published: 2025-08-13
Description: An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://gitlab.com/gitlab-org/gitlab/-/issues/549105
CVE: CVE-2025-8904
Published: 2025-08-13
Description: Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges. 



Users are advised to upgrade to Amazon EMR version 7.5 or higher. For Amazon EMR releases between 6.10 and 7.4, we strongly recommend that you run the bootstrap script and RPM files with the fix provided in the location below.
CVSS Score: 8.5 (HIGH)
CWE: CWE-257
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-017/; https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-750-release.html; https://github.com/advisories/GHSA-hf8h-76fm-735v
CVE: CVE-2025-8919
Published: 2025-08-13
Description: A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the component History Page. The manipulation of the argument código/objetivo habilidade leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/CVE-Hunters/CVE/blob/main/i-diario/CVE-2025-8919.md; https://github.com/FeMarb/CVEs/tree/6eeefb2749bb6165557ed4664a[PII_REDACTED]e4de/I-diario; https://vuldb.com/?ctiid.319878
CVE: CVE-2025-8920
Published: 2025-08-13
Description: A vulnerability was identified in Portabilis i-Diario 1.6. Affected by this vulnerability is an unknown functionality of the file /dicionario-de-termos-bncc of the component Dicionário de Termos BNCC Page. The manipulation of the argument Planos de ensino leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/CVE-Hunters/CVE/blob/main/i-diario/CVE-2025-8920.md; https://github.com/FeMarb/CVEs/blob/6eeefb2749bb6165557ed4664a[PII_REDACTED]e4de/I-diario/Cross-Site%20Scripting%20(XSS)%20Storage%20in%20endpoint%20_dicionario-de-termos-bncc%20parameter%20Planos%20de%20ensino%20input%20field.md; https://vuldb.com/?ctiid.319879
CVE: CVE-2025-8921
Published: 2025-08-13
Description: A vulnerability has been found in code-projects Job Diary 1.0. Affected by this issue is some unknown functionality of the file /user-apply.php. The manipulation of the argument job_title leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/caesar-power/CVE/issues/1; https://vuldb.com/?ctiid.319880
CVE: CVE-2025-43989
Published: 2025-08-13
Description: The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the ntpserver0 parameter, which is used in a system command. By setting a username=admin cookie (bypassing normal session checks), an unauthenticated attacker can use that parameter to execute arbitrary OS commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://drive.proton.me/urls/H7J1DPNA00#XrmRLENzyZAp; https://drive.proton.me/urls/QDVK6E2SBR#8LlpbHWzHdmr; https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2025-43989.txt
CVE: CVE-2025-45313
Published: 2025-08-13
Description: A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://hortusfox-web.com; https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-45313/CVE-2025-45313.md