deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10772
Published: 2025-09-22
Description: A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_devices/robots/lekiwi_remote.py of the component ZeroMQ Socket Handler. The manipulation leads to missing authentication. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287, CWE-306
References: https://vuldb.com/?ctiid.325128; https://vuldb.com/?id.325128; https://vuldb.com/?submit.649798
CVE: CVE-2025-10773
Published: 2025-09-22
Description: A security flaw has been discovered in B-Link BL-AC2100 up to 1.0.3. Affected by this issue is the function delshrpath of the file /goform/set_delshrpath_cfg of the component Web Management Interface. The manipulation of the argument Type results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/maximdevere/CVE2/blob/main/README.md; https://vuldb.com/?ctiid.325129; https://vuldb.com/?id.325129
CVE: CVE-2025-10774
Published: 2025-09-22
Description: A weakness has been identified in Ruijie 6000-E10 up to 2.4.3.6-20171117. This affects an unknown part of the file /view/vpn/autovpn/sub_commit.php. This manipulation of the argument key causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/maximdevere/CVE2/issues/1; https://vuldb.com/?ctiid.325130; https://vuldb.com/?id.325130
CVE: CVE-2025-10775
Published: 2025-09-22
Description: A security vulnerability has been detected in Wavlink WL-NU516U1 240425. This vulnerability affects the function sub_4012A0 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/swwer7000/iot; https://vuldb.com/?ctiid.325131; https://vuldb.com/?id.325131
CVE: CVE-2025-10776
Published: 2025-09-22
Description: A vulnerability was detected in LionCoders SalePro POS up to 5.5.0. This issue affects some unknown processing of the component Login. Performing manipulation results in cleartext transmission of sensitive information. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-310, CWE-319
References: https://github.com/PlsRevert/CVEs/issues/1; https://github.com/PlsRevert/CVEs/issues/1#issue[PII_REDACTED]; https://vuldb.com/?ctiid.325132
CVE: CVE-2025-10777
Published: 2025-09-22
Description: A flaw has been found in JSC R7 R7-Office Document Server up to 20250820. Impacted is an unknown function of the file /downloadas/. Executing manipulation of the argument cmd can lead to path traversal. The attack can be launched remotely. Upgrading to version 2025.3.1.923 is recommended to address this issue. The affected component should be upgraded. R7-Office is a fork of OpenOffice and at the moment it remains unclear if OpenOffice is affected as well. The OpenOffice team was not able to reproduce the issue in their codebase. The vendor replied: "We confirm that this vulnerability has been verified and patched in release 2025.3.1.923. During our security testing, it was not possible to exploit the issue - the server consistently returns proper error responses to the provided scenarios."
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.325133; https://vuldb.com/?id.325133; https://vuldb.com/?submit.638446
CVE: CVE-2025-10778
Published: 2025-09-22
Description: A vulnerability has been found in Smartstore up to 6.2.0. The affected element is an unknown function of the file /checkout/confirm/ of the component Gift Voucher Handler. The manipulation leads to race condition. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-362
References: https://vuldb.com/?ctiid.325134; https://vuldb.com/?id.325134; https://vuldb.com/?submit.640785
CVE: CVE-2025-10779
Published: 2025-09-22
Description: A vulnerability was found in D-Link DCS-935L up to 1.13.01. The impacted element is the function sub_402280 of the file /HNAP1/. The manipulation of the argument HNAP_AUTH/SOAPAction results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/scanleale/IOT_sec/blob/main/DCS-935L-1.pdf; https://github.com/scanleale/IOT_sec/blob/main/DCS-935L-2.pdf; https://vuldb.com/?ctiid.325135
CVE: CVE-2025-10780
Published: 2025-09-22
Description: A vulnerability was determined in CodeAstro Simple Pharmacy Management 1.0. This affects an unknown function of the file /view.php. This manipulation of the argument bar_code causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/yihaofuweng/cve/issues/26; https://vuldb.com/?ctiid.325136
CVE: CVE-2025-10781
Published: 2025-09-22
Description: A vulnerability was identified in Campcodes Online Learning Management System 1.0. This impacts an unknown function of the file /admin/edit_class.php. Such manipulation of the argument class_name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/88; https://vuldb.com/?ctiid.325137; https://vuldb.com/?id.325137
CVE: CVE-2025-59798
Published: 2025-09-22
Description: Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://bugs.ghostscript.com/show_bug.cgi?id=708539; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=0cae41b23a9669e801211dd4cf97b6dadd6dbdd7; https://lists.debian.org/debian-lts-announce/2025/10/msg00010.html
CVE: CVE-2025-59799
Published: 2025-09-22
Description: Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://bugs.ghostscript.com/show_bug.cgi?id=708517; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=6dab38fb211f15226c242ab7a83fa53e4b0ff781; https://lists.debian.org/debian-lts-announce/2025/10/msg00010.html
CVE: CVE-2025-59800
Published: 2025-09-22
Description: In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-190
References: https://bugs.ghostscript.com/show_bug.cgi?id=708602; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=176cf0188a2294bc307b8caec876f39412e58350; https://bugs.ghostscript.com/show_bug.cgi?id=708602
CVE: CVE-2025-59801
Published: 2025-09-22
Description: In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://bugs.ghostscript.com/show_bug.cgi?id=708819; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=[PII_REDACTED]7d548a8db69ba5d63f766bff40eaab
CVE: CVE-2025-10782
Published: 2025-09-22
Description: A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/class.php. Performing manipulation of the argument class_name results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/87; https://vuldb.com/?ctiid.325138; https://vuldb.com/?id.325138
CVE: CVE-2025-10783
Published: 2025-09-22
Description: A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_subject.php. Executing manipulation of the argument subject_code can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/86; https://vuldb.com/?ctiid.325139; https://vuldb.com/?id.325139
CVE: CVE-2025-10784
Published: 2025-09-22
Description: A security vulnerability has been detected in Campcodes Online Learning Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit_subject.php. The manipulation of the argument subject_code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/85; https://vuldb.com/?ctiid.325140; https://vuldb.com/?id.325140
CVE: CVE-2025-10785
Published: 2025-09-22
Description: A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown part of the file /manage_user.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/84; https://github.com/zzb1388/cve/issues/89; https://vuldb.com/?ctiid.325141
CVE: CVE-2025-9115
Published: 2025-09-22
Description: The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
CVSS Score: 5.6 (MEDIUM)
References: https://wpscan.com/vulnerability/67721fa5-4d4f-468b-aa77-c406e68fcf17/
CVE: CVE-2025-9487
Published: 2025-09-22
Description: The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads
CVSS Score: 4.7 (MEDIUM)
References: https://wpscan.com/vulnerability/b957b7c4-7a7c-497e-b8e4-499c821fb1b0/
CVE: CVE-2025-9540
Published: 2025-09-22
Description: The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 4.7 (MEDIUM)
References: https://wpscan.com/vulnerability/79e606df-50a0-4639-b2d9-4a77111fd729/
CVE: CVE-2025-9541
Published: 2025-09-22
Description: The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 4.7 (MEDIUM)
References: https://wpscan.com/vulnerability/3828b320-9f7b-4a2a-a6b0-200b023d602c/
CVE: CVE-2025-10786
Published: 2025-09-22
Description: A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=delete_user. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/83; https://vuldb.com/?ctiid.325142; https://vuldb.com/?id.325142
CVE: CVE-2025-10787
Published: 2025-09-22
Description: A vulnerability was found in MuYuCMS up to 2.7. Impacted is an unknown function of the file /index/index.html of the component Add Fiend Link Handler. Performing manipulation of the argument Link URL results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://gitee.com/MuYuCMS/MuYuCMS/issues/ICXV34; https://vuldb.com/?ctiid.325144; https://vuldb.com/?id.325144
CVE: CVE-2025-0875
Published: 2025-09-22
Description: Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System) allows Parameter Injection.This issue affects OBS (Student Affairs Information System): before v26.0328.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0282
CVE: CVE-2025-10788
Published: 2025-09-22
Description: A vulnerability was determined in SourceCodester Online Hotel Reservation System 1.0. The affected element is an unknown function of the file deleteroominventory.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/peri0d/my_cve/blob/main/Online-Hotel-Reservation-System-In-PHP-With-Source-Code-deleteroominventory.php-sql-injection.md; https://vuldb.com/?ctiid.325145; https://vuldb.com/?id.325145
CVE: CVE-2025-10789
Published: 2025-09-22
Description: A vulnerability was identified in SourceCodester Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file deleteslide.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://gold-textbook-8ff.notion.site/Online-Hotel-Reservation-System-In-PHP-With-Source-Code-deleteslide-php-sql-injection-26d85e97f353807585d7e600b31d339e; https://vuldb.com/?ctiid.325146; https://vuldb.com/?id.325146
CVE: CVE-2025-5962
Published: 2025-09-22
Description: A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication  calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284
References: https://access.redhat.com/errata/RHSA-2025:16345; https://access.redhat.com/errata/RHSA-2025:16346; https://access.redhat.com/security/cve/CVE-2025-5962
CVE: CVE-2025-10790
Published: 2025-09-22
Description: A security flaw has been discovered in SourceCodester Simple Forum Discussion System 1.0. This affects an unknown function of the file /ajax.php?action=save_category. The manipulation of the argument Description results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/26; https://vuldb.com/?ctiid.325147; https://vuldb.com/?id.325147
CVE: CVE-2025-10791
Published: 2025-09-22
Description: A weakness has been identified in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/index.php. This manipulation of the argument aduser causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/K1nakoo/cve/blob/main/26/report.md; https://vuldb.com/?ctiid.325148
CVE: CVE-2025-8079
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. Smart Trade E-Commerce allows Reflected XSS.This issue affects Smart Trade E-Commerce: before 4.5.0.0.1.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0283
CVE: CVE-2025-10009
Published: 2025-09-22
Description: Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files.
CWE: CWE-434
References: https://github.com/invoiceninja/invoiceninja/commit/02151b570b226b4584a8e61b06b10be9366da3de
CVE: CVE-2025-10792
Published: 2025-09-22
Description: A security vulnerability has been detected in D-Link DIR-513 A1FW110. Affected is an unknown function of the file /goform/formWPS. Such manipulation of the argument webpage leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-787
References: https://github.com/panda666-888/vuls/blob/main/d-link/dir-513/formWPS.md; https://github.com/panda666-888/vuls/blob/main/d-link/dir-513/formWPS.md#poc; https://vuldb.com/?ctiid.325149
CVE: CVE-2025-10793
Published: 2025-09-22
Description: A vulnerability was detected in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/admin_account_delete.php. Performing manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/K1nakoo/cve/blob/main/31/report.md; https://vuldb.com/?ctiid.325150
CVE: CVE-2025-25177
Published: 2025-09-22
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-416
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-9035
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS.This issue affects Virtual Library Platform: before v202.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0284
CVE: CVE-2025-10794
Published: 2025-09-22
Description: A flaw has been found in PHPGurukul Car Rental Project 3.0. Affected by this issue is some unknown functionality of the file /carrental/search.php. Executing manipulation of the argument autofocus can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/tddgns/cve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.325151
CVE: CVE-2025-10795
Published: 2025-09-22
Description: A vulnerability has been found in code-projects Online Bidding System 1.0. This affects an unknown part of the file /administrator/bidupdate.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/jackhong1236/cve_0/blob/main/12/tmp25/report.md; https://vuldb.com/?ctiid.325152
CVE: CVE-2025-46711
Published: 2025-09-22
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger NULL pointer dereference kernel exceptions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-9983
Published: 2025-09-22
Description: GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior.

The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable.
CWE: CWE-306
References: https://cert.pl/en/posts/2025/09/CVE-2025-9983; https://www.galayou-store.com/g2
CVE: CVE-2025-10796
Published: 2025-09-22
Description: A vulnerability was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /justines/admin/login.php. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/lishuyuan12138/CVE/issues/1; https://vuldb.com/?ctiid.325153
CVE: CVE-2025-10797
Published: 2025-09-22
Description: A vulnerability was determined in code-projects Hostel Management System 1.0. This issue affects some unknown processing of the file /justines/index.php. This manipulation of the argument log_email causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Waibibabo1239/CVE/issues/1; https://vuldb.com/?ctiid.325154
CVE: CVE-2025-10798
Published: 2025-09-22
Description: A vulnerability was identified in code-projects Hostel Management System 1.0. Impacted is an unknown function of the file /justines/admin/mod_roomtype/index.php?view=view. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/598600/CVE/issues/1; https://vuldb.com/?ctiid.325155
CVE: CVE-2025-10799
Published: 2025-09-22
Description: A security flaw has been discovered in code-projects Hostel Management System 1.0. The affected element is an unknown function of the file /justines/admin/mod_reservation/index.php?view=view. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yangzhenyu6/CVE/issues/1; https://vuldb.com/?ctiid.325156
CVE: CVE-2025-10854
Published: 2025-09-22
Description: The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhere in the filesystem when txtai is used to load untrusted embedding indices
CVSS Score: 8.1 (HIGH)
CWE: CWE-61
References: https://github.com/neuml/txtai/issues/965; https://research.jfrog.com/vulnerabilities/txtai-arbitrary-file-write-jfsa-2[PII_REDACTED]63/