deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5160
Published: 2025-05-26
Description: A vulnerability classified as problematic has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected is the function Download of the file /packetCaptureStrategy/download. The manipulation of the argument Name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://flowus.cn/share/3cec9266-793a-498e-acdb-4296b09a8c89?code=G8A6P3; https://vuldb.com/?ctiid.310248; https://vuldb.com/?id.310248
CVE: CVE-2025-5161
Published: 2025-05-26
Description: A vulnerability classified as problematic was found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this vulnerability is the function operationDailyOut of the file /safeEvent/download. The manipulation of the argument filename leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://flowus.cn/share/d78abd42-5de8-45f1-a941-a11a2581be0c?code=G8A6P3; https://vuldb.com/?ctiid.310249; https://vuldb.com/?id.310249
CVE: CVE-2025-5162
Published: 2025-05-26
Description: A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this issue is some unknown functionality of the file /safeEvent/importFile/. The manipulation of the argument logGeneralFile/logGeneralFile_2 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://flowus.cn/share/ce6c4094-8d97-466c-8fcc-df3f3d6f314e?code=G8A6P3; https://flowus.cn/share/d6c310ac-a179-499f-9e9a-5c0de80b19be?code=G8A6P3; https://vuldb.com/?ctiid.310250
CVE: CVE-2025-5163
Published: 2025-05-26
Description: A vulnerability, which was classified as problematic, was found in yangshare 技术杨工 warehouseManager 仓库管理系统 1.0. This affects an unknown part. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/sumingwjl/cve/issues/1; https://vuldb.com/?ctiid.310251; https://vuldb.com/?id.310251
CVE: CVE-2025-5164
Published: 2025-05-26
Description: A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-320, CWE-321, CWE-798
References: https://github.com/147536951/Qiany1/blob/main/Perfreeblog_3.pdf; https://vuldb.com/?ctiid.310252; https://vuldb.com/?id.310252
CVE: CVE-2025-5165
Published: 2025-05-26
Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-125, CWE-125
References: https://github.com/assimp/assimp/issues/6128; https://github.com/assimp/assimp/issues/6167; https://github.com/user-attachments/files/20204942/reproducer.zip
CVE: CVE-2025-5166
Published: 2025-05-26
Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-125, CWE-125
References: https://github.com/assimp/assimp/issues/6128; https://github.com/assimp/assimp/issues/6168; https://github.com/user-attachments/files/20208318/reproducer.zip
CVE: CVE-2025-5167
Published: 2025-05-26
Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-125, CWE-125
References: https://github.com/assimp/assimp/issues/6128; https://github.com/assimp/assimp/issues/6169; https://github.com/user-attachments/files/20208666/reproducer.zip
CVE: CVE-2025-5168
Published: 2025-05-26
Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-125, CWE-125
References: https://github.com/assimp/assimp/issues/6128; https://github.com/assimp/assimp/issues/6170; https://github.com/user-attachments/files/20208878/reproducer.zip
CVE: CVE-2025-5169
Published: 2025-05-26
Description: A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-125, CWE-125
References: https://github.com/assimp/assimp/issues/6128; https://github.com/assimp/assimp/issues/6171; https://github.com/user-attachments/files/20208891/reproducer.zip
CVE: CVE-2025-5170
Published: 2025-05-26
Description: A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5. This vulnerability affects the function AdminShitiListRequestVo of the file com\llisoft\controller\admin\shiti\AdminShitiController.java. The manipulation of the argument stTypeIds leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.310258; https://vuldb.com/?id.310258; https://vuldb.com/?submit.579069
CVE: CVE-2025-5171
Published: 2025-05-26
Description: A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function this.fileService.download of the file com\llisoft\controller\OpenController.java. The manipulation of the argument url leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://vuldb.com/?ctiid.310259; https://vuldb.com/?id.310259; https://vuldb.com/?submit.579088
CVE: CVE-2025-5172
Published: 2025-05-26
Description: A vulnerability, which was classified as critical, was found in Econtrata up to 20250516. Affected is an unknown function of the file /valida. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.310260; https://vuldb.com/?id.310260
CVE: CVE-2025-41441
Published: 2025-05-26
Description: Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker to obtain coupon codes. This vulnerability only affects products that use the coupon feature.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://jvn.jp/en/jp/JVN39546799/; https://www.synck.com/blogs/news/newsroom/detail_[PII_REDACTED].html
CVE: CVE-2025-5173
Published: 2025-05-26
Description: A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/HumanSignal/label-studio-ml-backend/issues/765; https://vuldb.com/?ctiid.310261; https://vuldb.com/?id.310261
CVE: CVE-2025-5174
Published: 2025-05-26
Description: A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypickle.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/erdogant/pypickle/commit/14b4cae704a0bb4eb6723e238f25382d847a1917; https://github.com/erdogant/pypickle/issues/2; https://github.com/erdogant/pypickle/issues/2#issuecomment[PII_REDACTED]
CVE: CVE-2025-5175
Published: 2025-05-26
Description: A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py. The manipulation leads to improper authorization. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/erdogant/pypickle/commit/14b4cae704a0bb4eb6723e238f25382d847a1917; https://github.com/erdogant/pypickle/issues/3; https://github.com/erdogant/pypickle/issues/3#issue[PII_REDACTED]
CVE: CVE-2025-5176
Published: 2025-05-26
Description: A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been declared as critical. This vulnerability affects unknown code of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to sql injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.310264; https://vuldb.com/?id.310264; https://vuldb.com/?submit.579849
CVE: CVE-2025-1985
Published: 2025-05-26
Description: Due to improper neutralization of input during web page generation (XSS) an unauthenticated remote attacker can inject HTML code into the Web-UI in the affected device.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.vde.com/en/advisories/VDE-2025-011
CVE: CVE-2025-41654
Published: 2025-05-26
Description: An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog.
CVSS Score: 8.2 (HIGH)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2025-011
CVE: CVE-2025-41655
Published: 2025-05-26
Description: An unauthenticated remote attacker can access a URL which causes the device to reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://certvde.com/en/advisories/VDE-2025-011
CVE: CVE-2025-35003
Published: 2025-05-26
Description: Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets.

NuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues.

This issue affects Apache NuttX: from 7.25 before 12.9.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121
References: https://github.com/apache/nuttx/pull/16179; https://lists.apache.org/thread/k4xzz3jhkx48zxw9vwmqrmm4hmg78vsj; http://www.openwall.com/lists/oss-security/2025/05/26/1
CVE: CVE-2025-40671
Published: 2025-05-26
Description: SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘fk_remoto_central’ parameter on the ‘/webservices/articles.php’ endpoint.
CWE: CWE-93
References: https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-aes-multimedias-gestnet
CVE: CVE-2025-40672
Published: 2025-05-26
Description: A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the file panLoad.exe that will be executed by SYSTEM user via a programmed task. This would allow an attacker to obtain administrator permissions to perform whatever activities he/she wants, shuch as accessing sensitive information, executing code remotely, and even causing a denial of service (DoS).
CWE: CWE-732
References: https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-proactivanet-espiral-ms-group
CVE: CVE-2025-4053
Published: 2025-05-26
Description: The data stored in Be-Tech Mifare Classic card is stored in cleartext. An attacker having access to a Be-Tech hotel guest Mifare Classic card can create a master key card that unlocks all the locks in the building. 

This issue affects all Be-Tech Mifare Classic card systems. To fix the vulnerability, it is necessary to replace the software, encoder, cards, and PCBs in the locks.
CWE: CWE-312
References: https://cert.pl/en/posts/2025/05/CVE-2025-4053/
CVE: CVE-2025-4057
Published: 2025-05-26
Description: A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1391
References: https://access.redhat.com/errata/RHSA-2025:12355; https://access.redhat.com/errata/RHSA-2025:12473; https://access.redhat.com/errata/RHSA-2025:8147
CVE: CVE-2025-5177
Published: 2025-05-26
Description: A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been rated as problematic. This issue affects some unknown processing of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to cross site scripting. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.310265; https://vuldb.com/?id.310265; https://vuldb.com/?submit.579850
CVE: CVE-2025-5178
Published: 2025-05-26
Description: A vulnerability classified as critical has been found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. Affected is an unknown function of the file /adm/ajax.php of the component Image File Handler. The manipulation of the argument files[] leads to unrestricted upload. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://vuldb.com/?ctiid.310266; https://vuldb.com/?id.310266; https://vuldb.com/?submit.579851
CVE: CVE-2025-5179
Published: 2025-05-26
Description: A vulnerability classified as problematic was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. Affected by this vulnerability is an unknown functionality of the file /adm/index.php of the component Cadastro de Administrador Page. The manipulation of the argument Name/Usuário leads to cross site scripting. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.310267; https://vuldb.com/?id.310267; https://vuldb.com/?submit.579852
CVE: CVE-2025-5180
Published: 2025-05-26
Description: A vulnerability, which was classified as critical, has been found in Wondershare Filmora 14.5.16. Affected by this issue is some unknown functionality in the library CRYPTBASE.dll of the file NFWCHK.exe of the component Installer. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-427, CWE-427
References: https://gist.github.com/shellkraft/aa66561e984e83052bd080f195a3ec80; https://vuldb.com/?ctiid.310268; https://vuldb.com/?id.310268
CVE: CVE-2025-5181
Published: 2025-05-26
Description: A vulnerability, which was classified as problematic, was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. This affects an unknown part of the file /spgpm/updateListing. The manipulation of the argument spgLsTitle leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79, CWE-639
References: https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS; https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS?tab=readme-ov-file#4%EF%B8%8F%E2%83%A3-inject-xss; https://summerpearlgroup.gr/spgpm/releases
CVE: CVE-2025-5182
Published: 2025-05-26
Description: A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unknown code of the component Listing Handler. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-639, CWE-639
References: https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS; https://summerpearlgroup.gr/spgpm/releases; https://vuldb.com/?ctiid.310270
CVE: CVE-2025-5183
Published: 2025-05-26
Description: A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as problematic. This issue affects some unknown processing of the component Header Handler. The manipulation of the argument Host leads to open redirect. The attack may be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://summerpearlgroup.gr/spgpm/releases; https://vuldb.com/?ctiid.310271; https://vuldb.com/?id.310271
CVE: CVE-2025-5184
Published: 2025-05-26
Description: A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. It has been classified as problematic. Affected is an unknown function of the component HTTP Response Header Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://summerpearlgroup.gr/spgpm/releases; https://vuldb.com/?ctiid.310272; https://vuldb.com/?id.310272
CVE: CVE-2025-40650
Published: 2025-05-26
Description: Insecure Direct Object Reference (IDOR) vulnerability in Clickedu. This vulnerability could allow an attacker to retrieve information about student report cards.
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-idor-clickedu
CVE: CVE-2025-40652
Published: 2025-05-26
Description: Stored Cross-Site Scripting (XSS) vulnerability in the CoverManager booking software. This allows an attacker to inject malicious scripts into the application, which are permanently stored on the server. The malicious scripts are executed in the browser of any user visiting the affected page without the user having to take any further action. This can allow the attacker to steal sensitive information, such as session cookies, login credentials, and perform actions on behalf of the affected user.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-covermanager
CVE: CVE-2025-40653
Published: 2025-05-26
Description: User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force attack on valid usernames.
CWE: CWE-209
References: https://www.incibe.es/en/incibe-cert/notices/aviso/user-enumeration-m3m-printer-server-web
CVE: CVE-2025-40663
Published: 2025-05-26
Description: Stored Cross-Site Scripting (XSS) vulnerability in i2A-Cronos version 23.02.01.17, from i2A. It allows an authenticated attacker to upload a malicious SVG image into the user's personal space in /CronosWeb/Modules/Persons/PersonalDocuments/PersonalDocuments.
There is no reported fix at this time.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-i2a-cronos-i2a
CVE: CVE-2025-40664
Published: 2025-05-26
Description: Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-0