deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-13370
Published: 2025-11-25
Description: The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://it.wordpress.org/plugins/projectlist/; https://plugins.trac.wordpress.org/browser/projectlist/tags/0.3.0/pages/pl-add.php#L61; https://plugins.trac.wordpress.org/browser/projectlist/trunk/pages/pl-add.php#L61
CVE: CVE-2025-13376
Published: 2025-11-25
Description: The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/projectlist/tags/0.3.0/pages/pl-add.php#L27; https://plugins.trac.wordpress.org/browser/projectlist/trunk/pages/pl-add.php#L27; https://www.wordfence.com/threat-intel/vulnerabilities/id/781c3b84-df80-470e-8bcb-3305a8bbb64a?source=cve
CVE: CVE-2025-13380
Published: 2025-11-25
Description: The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdai_update_post' AJAX endpoint and the use of file_get_contents() with user-controlled URLs without protocol restrictions in the insert_image() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://github.com/d0n601/CVE-2025-13380; https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L315; https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L423
CVE: CVE-2025-13382
Published: 2025-11-25
Description: The Frontend File Manager Plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 23.4. This is due to the plugin not validating file ownership before processing file rename requests in the '/wpfm/v1/file-rename' REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to rename files uploaded by other users via the 'fileid' parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L20; https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L52; https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.5/inc/classes/class.rest.php#L20
CVE: CVE-2025-13383
Published: 2025-11-25
Description: The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1. This is due to the plugin storing the entire unsanitized `$_GET` superglobal array directly into the database via `update_user_meta()` when users save search results, and later outputting this data without proper escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses the saved search or views their profile, granted they can trick the user into performing the search and saving the results.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L1680; https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L2354; https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L2355
CVE: CVE-2025-13385
Published: 2025-11-25
Description: The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/tags/4.2/app/admin/Bookings.php#L123; https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/trunk/app/admin/Bookings.php#L123; https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c17222-5de5-4ecd-a7c6-beabe7624c5b?source=cve
CVE: CVE-2025-13386
Published: 2025-11-25
Description: The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options_update' function in all versions up to, and including, 2.1.  This makes it possible for unauthenticated attackers to delete the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/social-images-widget/tags/2.1/class-social-images-widget-settings.php#L44; https://plugins.trac.wordpress.org/browser/social-images-widget/trunk/class-social-images-widget-settings.php#L44; https://www.wordfence.com/threat-intel/vulnerabilities/id/95ab7473-e368-47ad-a8a0-0efbdafce562?source=cve
CVE: CVE-2025-13389
Published: 2025-11-25
Description: The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L142; https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L142; https://plugins.trac.wordpress.org/changeset/3439999/
CVE: CVE-2025-13404
Published: 2025-11-25
Description: The atec Duplicate Page & Post plugin for WordPress is vulnerable to unauthorized post duplication due to missing authorization validation on the duplicate_post() function in all versions up to, and including, 1.2.20. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, including private and password-protected posts, leading to data exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/atec-duplicate-page-post/tags/1.2.20/includes/atec-wpdpp-hooks.php#L27; https://plugins.trac.wordpress.org/browser/atec-duplicate-page-post/tags/1.2.21/includes/atec-wpdpp-hooks.php#L27; https://www.wordfence.com/threat-intel/vulnerabilities/id/a793b24f-979e-4209-93f7-cff8d3867a7d?source=cve
CVE: CVE-2025-13405
Published: 2025-11-25
Description: The Ace Post Type Builder plugin for WordPress is vulnerable to unauthorized custom taxonomy deletion due to missing authorization validation on the cptb_delete_custom_taxonomy() function in all versions up to, and including, 1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary custom taxonomies.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/ace-post-type-builder/tags/1.9/includes/class-cptb-core.php#L400; https://plugins.trac.wordpress.org/browser/ace-post-type-builder/trunk/includes/class-cptb-core.php#L400; https://plugins.trac.wordpress.org/changeset/3412781/
CVE: CVE-2025-13414
Published: 2025-11-25
Description: The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business directory information, including sensitive business details.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/chamber-dashboard-business-directory/tags/3.3.11/options.php#L850; https://plugins.trac.wordpress.org/browser/chamber-dashboard-business-directory/trunk/options.php#L850; https://www.wordfence.com/threat-intel/vulnerabilities/id/1896885a-a104-464a-bb57-2c3c73ff9415?source=cve
CVE: CVE-2025-13452
Published: 2025-11-25
Description: The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L113; https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L56; https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L113
CVE: CVE-2025-13502
Published: 2025-11-25
Description: A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2025:22789; https://access.redhat.com/errata/RHSA-2025:22790; https://access.redhat.com/errata/RHSA-2025:23110
CVE: CVE-2025-59365
Published: 2025-11-25
Description: A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device. 
Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CWE: CWE-121
References: https://www.asus.com/security-advisory/
CVE: CVE-2025-59366
Published: 2025-11-25
Description: An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization.


Refer to the Security Update for ASUS Router Firmware section on the ASUS Security Advisory for more information.
CWE: CWE-22, CWE-78
References: https://www.asus.com/content/security-advisory/
CVE: CVE-2025-59368
Published: 2025-11-25
Description: An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device. 
Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CWE: CWE-191
References: https://www.asus.com/security-advisory/
CVE: CVE-2025-59369
Published: 2025-11-25
Description: A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary SQL queries, leading to unauthorized data access. 
Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CWE: CWE-89
References: https://www.asus.com/security-advisory/
CVE: CVE-2025-59370
Published: 2025-11-25
Description: A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary commands, leading to the device executing unintended instructions.
Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CWE: CWE-78
References: https://www.asus.com/security-advisory/
CVE: CVE-2025-59371
Published: 2025-11-25
Description: An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device. This vulnerability does not affect Wi-Fi 7 series models.
Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CWE: CWE-330
References: https://www.asus.com/security-advisory/
CVE: CVE-2025-59372
Published: 2025-11-25
Description: A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentially affecting device integrity.
Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CWE: CWE-22
References: https://www.asus.com/security-advisory/
CVE: CVE-2025-59485
Published: 2025-11-25
Description: Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an arbitrary file could be placed in the specific folder by a user who can log in to the system where the product's Windows client is installed. If the file is a specially crafted DLL file, arbitrary code could be executed with SYSTEM privilege.
CVSS Score: 3.3 (LOW)
CWE: CWE-276
References: https://jvn.jp/en/jp/JVN76298784/; https://www.intercom.co.jp/information/2025/1125.html
CVE: CVE-2025-62691
Published: 2025-11-25
Description: Security Point (Windows) of MaLion and MaLionCloud contains a stack-based buffer overflow vulnerability in processing HTTP headers. Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://jvn.jp/en/jp/JVN76298784/; https://www.intercom.co.jp/information/2025/1125.html
CVE: CVE-2025-64693
Published: 2025-11-25
Description: Security Point (Windows) of MaLion and MaLionCloud contains a heap-based buffer overflow vulnerability in processing Content-Length. Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://jvn.jp/en/jp/JVN76298784/; https://www.intercom.co.jp/information/2025/1125.html
CVE: CVE-2025-36134
Published: 2025-11-25
Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie.
CVSS Score: 3.7 (LOW)
CWE: CWE-1275
References: https://www.ibm.com/support/pages/node/7252210
CVE: CVE-2025-0248
Published: 2025-11-25
Description: HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-79
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127032
CVE: CVE-2025-13467
Published: 2025-11-25
Description: A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-502
References: https://access.redhat.com/errata/RHSA-2025:22088; https://access.redhat.com/errata/RHSA-2025:22089; https://access.redhat.com/errata/RHSA-2025:22090
CVE: CVE-2025-40890
Published: 2025-11-25
Description: A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.



An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be socially engineered to import a malicious dashboard template. When the victim views or imports the dashboard, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.
CVSS Score: 7.9 (HIGH)
CWE: CWE-79
References: https://security.nozominetworks.com/NN-2025:11-01
CVE: CVE-2025-60739
Published: 2025-11-25
Description: Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /bh_web_backend component
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-200, CWE-352
References: https://github.com/iSee857/ilevia-EVE-X1-Server-CSRF
CVE: CVE-2025-64049
Published: 2025-11-25
Description: A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/drive/folders/1SpwL548ZBRYU_uL8W7Riv7VHshr2UN0R?usp=sharing; https://github.com/redaxo/redaxo; https://github.com/vettrivel007/CVE-Disclosures/blob/main/CVE-2025-64049.md
CVE: CVE-2025-64050
Published: 2025-11-25
Description: A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://drive.google.com/drive/folders/1Via4r4wn5zCcBllWmHpxYweCPgcbN0bz?usp=sharing; https://github.com/redaxo/redaxo; https://github.com/vettrivel007/CVE-Disclosures/blob/main/CVE-2025-64050.md
CVE: CVE-2025-63729
Published: 2025-11-25
Description: An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certificate, and Client Certificates in .pem format in firmware in etc folder.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-200, CWE-312, CWE-532
References: https://github.com/Yashodhanvivek/CVE-2025-63729-Syrotech-SY-GPON-1110-/blob/main/Syrotech_SY-GPON-1110-WDONT_Security_Assessment.pdf
CVE: CVE-2025-64061
Published: 2025-11-25
Description: Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of their privilege level (including standard or low-privileged users), can make a GET request to this endpoint and retrieve a complete, unfiltered list of all registered application users. Crucially, the API response body for this endpoint includes password hashes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64061.md; https://www.primakon.com/rjesenja/primakon-pcm/
CVE: CVE-2025-13483
Published: 2025-11-25
Description: SiRcom SMART Alert (SiSA) allows unauthorized access to backend APIs. This allows an unauthenticated attacker to bypass the login screen using browser developer tools, gaining access to restricted parts of the application.
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-06
CVE: CVE-2025-33187
Published: 2025-11-25
Description: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areas. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, denial of service, or escalation of privileges.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-269
References: https://nvd.nist.gov/vuln/detail/CVE-2025-33187; https://nvidia.custhelp.com/app/answers/detail/a_id/5720; https://www.cve.org/CVERecord?id=CVE-2025-33187
CVE: CVE-2025-33188
Published: 2025-11-25
Description: NVIDIA DGX Spark GB10 contains a vulnerability in hardware resources where an attacker could tamper with hardware controls. A successful exploit of this vulnerability might lead to information disclosure, data tampering, or denial of service.
CVSS Score: 8.0 (HIGH)
CWE: CWE-269
References: https://nvd.nist.gov/vuln/detail/CVE-2025-33188; https://nvidia.custhelp.com/app/answers/detail/a_id/5720; https://www.cve.org/CVERecord?id=CVE-2025-33188
CVE: CVE-2025-33189
Published: 2025-11-25
Description: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an out-of-bound write. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, information disclosure, or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://nvd.nist.gov/vuln/detail/CVE-2025-33189; https://nvidia.custhelp.com/app/answers/detail/a_id/5720; https://www.cve.org/CVERecord?id=CVE-2025-33189
CVE: CVE-2025-33190
Published: 2025-11-25
Description: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware where an attacker could cause an out-of-bound write. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, or escalation of privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://nvd.nist.gov/vuln/detail/CVE-2025-33190; https://nvidia.custhelp.com/app/answers/detail/a_id/5720; https://www.cve.org/CVERecord?id=CVE-2025-33190
CVE: CVE-2025-33191
Published: 2025-11-25
Description: NVIDIA DGX Spark GB10 contains a vulnerability in OSROOT firmware, where an attacker could cause an invalid memory read. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: https://nvd.nist.gov/vuln/detail/CVE-2025-33191; https://nvidia.custhelp.com/app/answers/detail/a_id/5720; https://www.cve.org/CVERecord?id=CVE-2025-33191
CVE: CVE-2025-33192
Published: 2025-11-25
Description: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an arbitrary memory read. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-690
References: https://nvd.nist.gov/vuln/detail/CVE-2025-33192; https://nvidia.custhelp.com/app/answers/detail/a_id/5720; https://www.cve.org/CVERecord?id=CVE-2025-33192