deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6445
Published: 2025-06-25
Description: ServiceStack FindType Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ServiceStack. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of the FindType method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25837.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://docs.servicestack.net/releases/v8_06#reported-vulnerabilities; https://www.zerodayinitiative.com/advisories/ZDI-25-416/
CVE: CVE-2025-6618
Published: 2025-06-25
Description: A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified as critical. Affected is the function SetWLanApcliSettings of the file wps.so. The manipulation of the argument PIN leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_44/44.md; https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_44/44.md#poc; https://vuldb.com/?ctiid.313836
CVE: CVE-2025-6619
Published: 2025-06-25
Description: A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function setUpgradeFW of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md; https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_45/45.md#poc; https://vuldb.com/?ctiid.313837
CVE: CVE-2025-6620
Published: 2025-06-25
Description: A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as critical. Affected by this issue is the function setUpgradeUboot of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.md; https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_46/46.md#poc; https://vuldb.com/?ctiid.313838
CVE: CVE-2025-6621
Published: 2025-06-25
Description: A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.so. The manipulation of the argument hour/minute leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md; https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_47/47.md#poc; https://vuldb.com/?ctiid.313839
CVE: CVE-2025-6678
Published: 2025-06-25
Description: Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.zerodayinitiative.com/advisories/ZDI-25-342/
CVE: CVE-2025-6627
Published: 2025-06-25
Description: A vulnerability has been found in TOTOLINK A702R 4.0.0-B20[PII_REDACTED] and classified as critical. This vulnerability affects unknown code of the file /boafrm/formIpv6Setup of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/d2pq/cve/blob/main/616/24.md; https://github.com/d2pq/cve/blob/main/616/24.md#poc; https://vuldb.com/?ctiid.313852
CVE: CVE-2025-45333
Published: 2025-06-25
Description: berkeley-abc abc 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the Abc_NtkCecFraigPart function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://gist.github.com/QiuYitai/eb49750fe58e39ce685cfd87a41eacb9; https://github.com/berkeley-abc/abc/pull/383; https://github.com/berkeley-abc/abc/pull/383
CVE: CVE-2025-36038
Published: 2025-06-25
Description: IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502
References: https://www.ibm.com/support/pages/node/7237967
CVE: CVE-2025-6664
Published: 2025-06-25
Description: A vulnerability, which was classified as problematic, was found in CodeAstro Patient Record Management System 1.0. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://codeastro.com/; https://github.com/Vanshdhawan188/CodeAstro-Online-Healthcare-Patient-Record-Management-System-CSRF/blob/main/CodeAstro-Online-Healthcare-Patient-Record-Management-System-CSRF.md; https://github.com/Vanshdhawan188/CodeAstro-Online-Healthcare-Patient-Record-Management-System-CSRF/blob/main/CodeAstro-Online-Healthcare-Patient-Record-Management-System-CSRF.md#-steps-to-reproduce
CVE: CVE-2025-6665
Published: 2025-06-25
Description: A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /php_action/editBrand.php. The manipulation of the argument editBrandStatus leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/catfish258/cve/issues/1; https://vuldb.com/?ctiid.313879
CVE: CVE-2025-6443
Published: 2025-06-25
Description: Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configured values prior to allowing ingress traffic into the internal network. An attacker can leverage this vulnerability to gain access to internal network resources. Was ZDI-CAN-26415.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://www.zerodayinitiative.com/advisories/ZDI-25-424/
CVE: CVE-2025-6640
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26527.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-425/
CVE: CVE-2025-6641
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26528.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-426/
CVE: CVE-2025-6642
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26530.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-427/
CVE: CVE-2025-6643
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26532.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-428/
CVE: CVE-2025-6644
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26536.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-429/
CVE: CVE-2025-6645
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26642.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-430/
CVE: CVE-2025-6646
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26643.
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-431/
CVE: CVE-2025-6647
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26644.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-432/
CVE: CVE-2025-6648
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26671.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-433/
CVE: CVE-2025-6649
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26709.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-434/
CVE: CVE-2025-6650
Published: 2025-06-25
Description: PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26712.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-435/
CVE: CVE-2025-6651
Published: 2025-06-25
Description: PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26713.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-436/
CVE: CVE-2025-6652
Published: 2025-06-25
Description: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26724.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-437/
CVE: CVE-2025-6653
Published: 2025-06-25
Description: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26726.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-438/
CVE: CVE-2025-6654
Published: 2025-06-25
Description: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26729.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-439/
CVE: CVE-2025-6655
Published: 2025-06-25
Description: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26730.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-440/
CVE: CVE-2025-6656
Published: 2025-06-25
Description: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26731.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-441/
CVE: CVE-2025-6657
Published: 2025-06-25
Description: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26732.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-442/