deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12922
Published: 2025-11-10
Description: A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xml_file results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md; https://github.com/mikecole-mg/security_findings/blob/main/openclinica/openclinica-rce.md#raw-requests-abridged; https://vuldb.com/?ctiid.331642
CVE: CVE-2025-12923
Published: 2025-11-10
Description: A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/download. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 2.7 (LOW)
CWE: CWE-22
References: https://github.com/Huu1j/CVE/blob/main/chestnutcms%20Arbitrary%20File%20Read.md; https://vuldb.com/?ctiid.331643; https://vuldb.com/?id.331643
CVE: CVE-2025-12924
Published: 2025-11-10
Description: A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads to missing authorization. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-863, CWE-862
References: https://github.com/rymcu/forest/; https://github.com/rymcu/forest/issues/198; https://vuldb.com/?ctiid.331644
CVE: CVE-2025-12925
Published: 2025-11-10
Description: A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. The manipulation results in missing authorization. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862, CWE-863, CWE-862
References: https://github.com/rymcu/forest/; https://github.com/rymcu/forest/issues/199; https://vuldb.com/?ctiid.331645
CVE: CVE-2025-12864
Published: 2025-11-10
Description: U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10489-a5a6d-2.html; https://www.twcert.org.tw/tw/cp-132-10488-2df22-1.html
CVE: CVE-2025-12865
Published: 2025-11-10
Description: U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10489-a5a6d-2.html; https://www.twcert.org.tw/tw/cp-132-10488-2df22-1.html
CVE: CVE-2025-12866
Published: 2025-11-10
Description: EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://www.twcert.org.tw/en/cp-139-10491-004b0-2.html; https://www.twcert.org.tw/tw/cp-132-10490-2534b-1.html; https://www.chtsecurity.com/news/20848f61-9db5-44fd-8574-c9d6a54e4010
CVE: CVE-2025-12926
Published: 2025-11-10
Description: A weakness has been identified in SourceCodester Farm Management System 1.0. The affected element is an unknown function of the file /review.php. This manipulation of the argument pid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/R178/cve/issues/1; https://vuldb.com/?ctiid.331646; https://vuldb.com/?id.331646
CVE: CVE-2025-12927
Published: 2025-11-10
Description: A security vulnerability has been detected in DedeBIZ up to 6.3.2. The impacted element is an unknown function of the file /admin/archives_add.php. Such manipulation of the argument flags[] leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ZZCTD/zz_test/issues/4; https://vuldb.com/?ctiid.331647; https://vuldb.com/?id.331647
CVE: CVE-2025-12867
Published: 2025-11-10
Description: EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-10491-004b0-2.html; https://www.twcert.org.tw/tw/cp-132-10490-2534b-1.html; https://www.chtsecurity.com/news/20848f61-9db5-44fd-8574-c9d6a54e4010
CVE: CVE-2025-12868
Published: 2025-11-10
Description: New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-603
References: https://www.twcert.org.tw/en/cp-139-10492-84a10-2.html; https://www.twcert.org.tw/tw/cp-132-10493-bf807-1.html
CVE: CVE-2025-12928
Published: 2025-11-10
Description: A vulnerability was detected in code-projects Online Job Search Engine 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument username/phone results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/lakshayyverma/CVE-Discovery/blob/main/Online%20Job%20Search%20Engine.md; https://github.com/lakshayyverma/CVE-Discovery/blob/main/Online%20Job%20Search%20Engine.md#proof-of-concept-poc
CVE: CVE-2025-12929
Published: 2025-11-10
Description: A flaw has been found in SourceCodester Survey Application System 1.0. This impacts the function save_user/update_user of the file /LoginRegistration.php. Executing manipulation of the argument fullname can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lakshayyverma/CVE-Discovery/blob/main/Survey%20Application%20System.md; https://vuldb.com/?ctiid.331649; https://vuldb.com/?id.331649
CVE: CVE-2025-12930
Published: 2025-11-10
Description: A vulnerability has been found in SourceCodester Food Ordering System 1.0. Affected is an unknown function of the file /view-ticket.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/puppytgyh/-CVE/issues/1; https://vuldb.com/?ctiid.331650; https://vuldb.com/?id.331650
CVE: CVE-2025-12613
Published: 2025-11-10
Description: Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a variety of malicious outcomes, such as bypassing security checks, altering data, or manipulating the application's behavior.**Note:**Following our established security policy, we attempted to contact the maintainer regarding this vulnerability, but haven't received a response.
CVSS Score: 8.6 (HIGH)
CWE: CWE-88
References: https://github.com/cloudinary/cloudinary_npm/commit/ec4b65f2b3461365c569198ed6d2cfa61cca4050; https://github.com/cloudinary/cloudinary_npm/pull/709; https://security.snyk.io/vuln/SNYK-JS-CLOUDINARY-10495740
CVE: CVE-2025-12931
Published: 2025-11-10
Description: A vulnerability was found in SourceCodester Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/edit-orders.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/puppytgyh/-CVE/issues/5; https://vuldb.com/?ctiid.331651; https://vuldb.com/?id.331651
CVE: CVE-2025-12932
Published: 2025-11-10
Description: A vulnerability was determined in SourceCodester Baby Care System 1.0. Affected by this issue is some unknown functionality of the file /admin.php?id=inbox. This manipulation of the argument msgid causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/puppytgyh/-CVE/issues/7; https://vuldb.com/?ctiid.331652; https://vuldb.com/?id.331652
CVE: CVE-2025-59777
Published: 2025-11-10
Description: NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://git.gnunet.org/libmicrohttpd.git/commit/?id=ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b; https://jvn.jp/en/jp/JVN76719218/; https://www.gnu.org/software/libmicrohttpd/
CVE: CVE-2025-62689
Published: 2025-11-10
Description: NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://git.gnunet.org/libmicrohttpd.git/commit/?id=ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b; https://jvn.jp/en/jp/JVN76719218/; https://www.gnu.org/software/libmicrohttpd/
CVE: CVE-2025-12933
Published: 2025-11-10
Description: A vulnerability was identified in SourceCodester Baby Care System 1.0. This affects an unknown part of the file /updatewelcome.php?id=siteoptions&action=welcome. Such manipulation of the argument roleid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/puppytgyh/-CVE/issues/8; https://vuldb.com/?ctiid.331653; https://vuldb.com/?id.331653
CVE: CVE-2025-41731
Published: 2025-11-10
Description: A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.
CVSS Score: 7.4 (HIGH)
CWE: CWE-338
References: https://jumo.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-086.json
CVE: CVE-2025-12155
Published: 2025-11-10
Description: A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system.

Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted instances. No user action is required for these.

Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page  https://download.looker.com/ :
  *  24.12.100+
  *  24.18.192+
  *  25.0.69+
  *  25.6.57+
  *  25.8.39+
  *  25.10.22+
CWE: CWE-77
References: https://cloud.google.com/support/bulletins#gcp-2025-052
CVE: CVE-2025-12397
Published: 2025-11-10
Description: A SQL injection vulnerability was found in Looker Studio.

A Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected to reports with BigQuery as the data source.

This vulnerability was patched on 21 July 2025, and no customer action is needed.
CWE: CWE-89
References: https://cloud.google.com/support/bulletins#gcp-2025-053; https://www.tenable.com/security/research/tra-2025-28
CVE: CVE-2025-12409
Published: 2025-11-10
Description: A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources.
 
By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery.

This vulnerability was patched on 07 July 2025, and no customer action is needed.
CWE: CWE-89
References: https://cloud.google.com/support/bulletins#gcp-2025-053; https://www.tenable.com/security/research/tra-2025-27
CVE: CVE-2025-41107
Published: 2025-11-10
Description: Stored Cross Site Scripting (XSS) vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/online_admission', wich affects the parameters 'firstname', 'lastname', 'guardian_name' and others. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal his/her session cookie details.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-smart-school
CVE: CVE-2025-12405
Published: 2025-11-10
Description: An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors.

A Looker Studio user with report view access could make a copy of the report and execute arbitrary SQL that would run on the data source database due to the stored credentials attached to the report.

This vulnerability was patched on 21 July 2025, and no customer action is needed.
CWE: CWE-269
References: https://cloud.google.com/support/bulletins#gcp-2025-053; https://www.tenable.com/security/research/tra-2025-29
CVE: CVE-2025-41001
Published: 2025-11-10
Description: Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUT_REDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-soplanning
CVE: CVE-2025-12938
Published: 2025-11-10
Description: A vulnerability was identified in projectworlds Online Admission System 1.0. Affected by this vulnerability is an unknown functionality of the file /process_login.php. The manipulation of the argument keywords leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/juzidddd/CVE/issues/1; https://vuldb.com/?ctiid.331662; https://vuldb.com/?id.331662
CVE: CVE-2025-12939
Published: 2025-11-10
Description: A security flaw has been discovered in SourceCodester Interview Management System up to 1.0. Affected by this issue is some unknown functionality of the file /addCandidate.php. The manipulation of the argument candName results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/puppytgyh/-CVE/issues/10; https://vuldb.com/?ctiid.331663; https://vuldb.com/?id.331663
CVE: CVE-2025-64456
Published: 2025-11-10
Description: In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation
CVSS Score: 8.4 (HIGH)
CWE: CWE-347
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-64457
Published: 2025-11-10
Description: In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-367, CWE-362
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-64681
Published: 2025-11-10
Description: In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations
CVSS Score: 2.7 (LOW)
CWE: CWE-862, CWE-862
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-64682
Published: 2025-11-10
Description: In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit
CVSS Score: 2.7 (LOW)
CWE: CWE-362, CWE-362
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-64683
Published: 2025-11-10
Description: In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-64684
Published: 2025-11-10
Description: In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-64685
Published: 2025-11-10
Description: In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-64686
Published: 2025-11-10
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it was fixed before public disclosure and did not affect any released versions.
CVE: CVE-2025-64687
Published: 2025-11-10
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it was fixed before public disclosure and did not affect any released versions.
CVE: CVE-2025-64688
Published: 2025-11-10
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it relates to internal functionality that is not available to customers.
CVE: CVE-2025-64689
Published: 2025-11-10
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it relates to internal functionality that is not available to customers.
CVE: CVE-2025-64690
Published: 2025-11-10
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it relates to internal functionality that is not available to customers.
CVE: CVE-2025-12480
Published: 2025-11-10
Description: Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://access.triofox.com/releases_history/; https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0008.md
CVE: CVE-2025-63709
Published: 2025-11-10
Description: A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submit HTML/JavaScript that is not correctly sanitized or encoded on output. The injected script is stored and later rendered in the browser of any user who views the task, allowing execution of arbitrary script in the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/floccocam-cpu/CVE-Research-2025/tree/main/CVE-2025-63709; https://www.sourcecodester.com/php/17897/simple-do-list-system-using-php.html
CVE: CVE-2025-63710
Published: 2025-11-10
Description: The send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF). The application does not implement any CSRF-protection mechanisms such as tokens, nonces, or same-site cookie restrictions. An attacker can create a malicious HTML page that, when visited by an authenticated user, will automatically submit a forged POST request to the vulnerable endpoint. This request will be executed with the victim's privileges, allowing the attacker to perform unauthorized actions on their behalf, such as sending arbitrary messages in any chat room.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63710/README2.md; https://www.sourcecodester.com/php/12295/simple-public-chat-room-using-php.html
CVE: CVE-2025-63711
Published: 2025-11-10
Description: A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion actions without their consent. The application's user deletion endpoint (e.g., superadmin_user_delete.php) accepts POST requests containing a user_id parameter and does not enforce request origin or anti-CSRF tokens. Because the endpoint lacks proper authentication/authorization checks and CSRF protections, a remote attacker can craft a malicious page that triggers deletion when visited by an authenticated admin, resulting in arbitrary removal of user accounts.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63711/README3.md; https://www.sourcecodester.com/php/17514/client-database-management-system.html
CVE: CVE-2025-63712
Published: 2025-11-10
Description: Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System. The User Management module (delete-user.php) allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF protection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63712/README4.md; https://www.sourcecodester.com/php/17883/web-based-product-alert-system.html
CVE: CVE-2025-8768
Published: 2025-11-10
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-12020. Reason: This candidate is a reservation duplicate of CVE-2025-12020. Notes: All CVE users should reference CVE-2025-12020 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.