deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7809
Published: 2025-07-29
Description: The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/streamweasels-twitch-integration/trunk/public/js/streamweasels-public.js#L1349; https://plugins.trac.wordpress.org/changeset/3335250; https://www.wordfence.com/threat-intel/vulnerabilities/id/eed5b1ea-213c-4a37-b357-8d058af86d38?source=cve
CVE: CVE-2025-7810
Published: 2025-07-29
Description: The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/streamweasels-kick-integration/trunk/public/js/streamweasels-kick-public.js#L574; https://plugins.trac.wordpress.org/changeset/3335307#file11; https://www.wordfence.com/threat-intel/vulnerabilities/id/b564eacd-1561-4c42-8a9e-395d4e951723?source=cve
CVE: CVE-2025-7811
Published: 2025-07-29
Description: The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/streamweasels-youtube-integration/trunk/public/js/streamweasels-youtube-public.js#L874; https://plugins.trac.wordpress.org/changeset/3335284#file11; https://www.wordfence.com/threat-intel/vulnerabilities/id/fb6783b4-f7a5-4f8f-a8d0-5f5c7f91f687?source=cve
CVE: CVE-2025-3075
Published: 2025-07-29
Description: The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts sites with 'Element Caching' enabled.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3302102%40elementor&new=3302102%40elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/639693b6-369e-457e-a37e-30bdb8ea7275?source=cve
CVE: CVE-2025-4370
Published: 2025-07-29
Description: The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_urls function as well as missing path validation in store_file function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated attackers to upload .TXT files on the affected site's server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/brizy/tags/2.6.17/editor/asset/media-processor.php#L27; https://plugins.trac.wordpress.org/browser/brizy/tags/2.6.17/editor/asset/static-file-trait.php#L44; https://www.wordfence.com/threat-intel/vulnerabilities/id/db18f6b4-600d-4c63-a9f2-4e3b8ab4fba3?source=cve
CVE: CVE-2025-4566
Published: 2025-07-29
Description: The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text DOM element attribute in Text Path widget in all versions up to, and including, 3.30.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This attack affects only Chrome/Edge browsers
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/elementor/tags/3.28.4/assets/js/text-path.acb8842ac7e1cd1dfb44.bundle.js#L147; https://plugins.trac.wordpress.org/browser/elementor/tags/3.28.4/assets/js/text-path.acb8842ac7e1cd1dfb44.bundle.js#L190; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3332337%40elementor&new=3332337%40elementor&sfp_email=&sfph_mail=
CVE: CVE-2025-53077
Published: 2025-07-29
Description: An execution after redirect in Samsung DMS(Data Management Server) allows attackers to execute limited functions without permissions. An attacker could compromise the integrity of the platform by executing this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-698
References: https://security.samsungda.com/securityUpdates.html
CVE: CVE-2025-53078
Published: 2025-07-29
Description: Deserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to execute arbitrary code via write file to system
CVSS Score: 8.0 (HIGH)
CWE: CWE-502
References: https://security.samsungda.com/securityUpdates.html
CVE: CVE-2025-53079
Published: 2025-07-29
Description: Absolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker (Administrator) to read sensitive files
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-36
References: https://security.samsungda.com/securityUpdates.html
CVE: CVE-2025-53080
Published: 2025-07-29
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Samsung DMS(Data Management Server) allows authenticated attackers to create arbitrary files in unintended locations on the filesystem
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://security.samsungda.com/securityUpdates.html
CVE: CVE-2025-53649
Published: 2025-07-29
Description: "SwitchBot" App for iOS/Android contains an insertion of sensitive information into log file vulnerability in versions V6.24 through V9.12. If this vulnerability is exploited, sensitive user information may be exposed to an attacker who has access to the application logs.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-532
References: https://jvn.jp/en/jp/JVN59585716/; https://www.switchbot.jp/pages/switchbot-app-vulnerability-fix202507
CVE: CVE-2025-6495
Published: 2025-07-29
Description: The Bricks theme for WordPress is vulnerable to blind SQL Injection via the ‘p’ parameter in all versions up to, and including, 1.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://bricksbuilder.io/; https://bricksbuilder.io/release/bricks-2-0/#full-changelog; https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac49a00-dabc-4cd9-9032-c038ede3fd8f?source=cve
CVE: CVE-2025-8264
Published: 2025-07-29
Description: Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modify or delete sensitive data from a linked third-party database. **Note:** This vulnerability affects Z-Push installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUERY option configured.  MitigationChange configuration to use the default or LDAP in backend/imap/config.phpphpdefine('IMAP_DEFAULTFROM', '');orphpdefine('IMAP_DEFAULTFROM', 'ldap');
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Z-Hub/Z-Push/blob/af25a2169a50d6e05a5916d1e8b2b6cd17011c98/src/backend/imap/user_identity.php%23L211C9-L214C25; https://github.com/Z-Hub/Z-Push/pull/161; https://github.com/Z-Hub/Z-Push/pull/161/commits/f981d515a35ac4c303959af21dce880a5db02786
CVE: CVE-2025-53081
Published: 2025-07-29
Description: An 'Arbitrary File Creation' in Samsung DMS(Data Management Server) allows attackers to create arbitrary files in unintended locations on the filesystem. Exploitation is restricted to specific, authorized private IP addresses.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: https://security.samsungda.com/securityUpdates.html
CVE: CVE-2025-53082
Published: 2025-07-29
Description: An 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete arbitrary files from unintended locations on the filesystem. Exploitation is restricted to specific, authorized private IP addresses.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-23
References: https://security.samsungda.com/securityUpdates.html
CVE: CVE-2025-26400
Published: 2025-07-29
Description: SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611
References: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26400
CVE: CVE-2025-6681
Published: 2025-07-29
Description: The Fan Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/fan-page/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/7f86a85c-fe40-4020-b4d2-623dabac98a2?source=cve
CVE: CVE-2025-6692
Published: 2025-07-29
Description: The YouTube Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘instance’ parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/youram-youtube-embed/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/cf558c77-fc78-4149-bc7f-2b5353144daf?source=cve
CVE: CVE-2025-6730
Published: 2025-07-29
Description: The Bonanza – WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlo_optin_call() function in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set the opt in status to success.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/bonanza-woocommerce-free-gifts-lite/trunk/xl/includes/class-xl-opt-in-manager.php#L244; https://www.wordfence.com/threat-intel/vulnerabilities/id/3c7a192b-25cc-4041-a72b-34fbd697045b?source=cve
CVE: CVE-2025-7689
Published: 2025-07-29
Description: The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password of an Administrator user, achieving full privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3334439/; https://wordpress.org/plugins/hydra-booking/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/93027dd1-f36a-4954-a8d2-b77bbbaef6fb?source=cve
CVE: CVE-2025-8196
Published: 2025-07-29
Description: The Magical Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3334530/; https://wordpress.org/plugins/magical-addons-for-elementor/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/58854b23-e679-4349-aa7c-4edf4008c92a?source=cve
CVE: CVE-2025-8216
Published: 2025-07-29
Description: The Sky Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple widgets in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3334452/; https://wordpress.org/plugins/sky-elementor-addons/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/17240221-01b2-4a21-9e9f-f940280c0fb7?source=cve
CVE: CVE-2025-5587
Published: 2025-07-29
Description: The Appzend theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘progressbarLayout’ parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/browser/appzend/1.2.6/blocks-extends/blocks/progressbar.php#L44; https://themes.trac.wordpress.org/changeset/281244/; https://wordpress.org/themes/appzend/
CVE: CVE-2025-40682
Published: 2025-07-29
Description: SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
CVE: CVE-2025-40683
Published: 2025-07-29
Description: Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searccity' parameter in /city.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
CVE: CVE-2025-40684
Published: 2025-07-29
Description: Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searccountry' parameter in/country.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
CVE: CVE-2025-40685
Published: 2025-07-29
Description: Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searcstate' parameter in/state.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
CVE: CVE-2025-40686
Published: 2025-07-29
Description: Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'employeeid' parameter in/detailview.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
CVE: CVE-2025-41241
Published: 2025-07-29
Description: VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perform API calls for guest OS customisation may trigger this vulnerability to create a denial-of-service condition.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-754
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35964
CVE: CVE-2025-54422
Published: 2025-07-29
Description: Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory, exposing them to potential interception. The vulnerability is particularly severe during password modification operations, where both old and new passwords are passed as plaintext command-line arguments to the Imbox process without any encryption or obfuscation. This implementation flaw allows any process within the user session, including unprivileged processes, to retrieve these sensitive credentials by reading the command-line arguments, thereby bypassing standard privilege requirements and creating a significant security risk. This is fixed in version 1.16.2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-322, CWE-497, CWE-522
References: https://github.com/sandboxie-plus/Sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a; https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.16.2; https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-jp7r-vgv9-43p7
CVE: CVE-2025-6060
Published: 2025-07-29
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DECE Software Geodi allows Cross-Site Scripting (XSS).This issue affects Geodi: before GEODI Setup 9.0.146.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0182
CVE: CVE-2025-6175
Published: 2025-07-29
Description: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in DECE Software Geodi allows HTTP Request Splitting.This issue affects Geodi: before GEODI Setup 9.0.146.
CVSS Score: 7.2 (HIGH)
CWE: CWE-93
References: https://www.usom.gov.tr/bildirim/tr-25-0182
CVE: CVE-2025-6504
Published: 2025-07-29
Description: In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. 

Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.


This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.
CVSS Score: 8.4 (HIGH)
CWE: CWE-345
References: https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6504
CVE: CVE-2025-6505
Published: 2025-07-29
Description: Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access.
 When OAuth Clients perform an OAuth handshake with the Hybrid Data Pipeline Server, the server accepts client credentials from both HTTP headers and request parameters.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6505
CVE: CVE-2025-7458
Published: 2025-07-29
Description: An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-190
References: https://sqlite.org/forum/forumpost/16ce2bb7a639e29b; https://sqlite.org/src/info/12ad822d9b827777
CVE: CVE-2024-42644
Published: 2025-07-29
Description: FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS value of the publish object is greater than 0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/halfgaar/FlashMQ; https://github.com/songxpu/bug_report/blob/master/MQTT/FlashMQ/cve-2024-42644.md; https://www.flashmq.org/2024/06/17/flashmq-1-15-1-released/
CVE: CVE-2024-42645
Published: 2025-07-29
Description: An issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/halfgaar/FlashMQ; https://github.com/songxpu/bug_report/blob/master/MQTT/FlashMQ/CVE-2024-42645.md; https://www.flashmq.org/2024/06/17/flashmq-1-15-1-released/
CVE: CVE-2025-52358
Published: 2025-07-29
Description: A cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 and below. This issue allows attackers to inject JavaScript payloads within the error or edit-menu-item parameters which are then executed in the victim's browser session.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/MatJosephs/CVEs/blob/main/CVE-2025-52358/README.md; https://vivaldigroup.it/en/
CVE: CVE-2025-28172
Published: 2025-07-29
Description: Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307
References: http://grandstream.com; https://gist.github.com/Exek1el/6291185a87c98d[PII_REDACTED]b2bd5cdf