deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7962
Published: 2025-07-21
Description: In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-147
References: https://gitlab.eclipse.org/security/cve-assignement/-/issues/67; http://www.openwall.com/lists/oss-security/2025/09/03/4
CVE: CVE-2020-26799
Published: 2025-07-21
Description: A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://suryadina.com/luxcal-reflected-xss-cve-2020-26799/; https://www.luxsoft.eu/index.php?pge=dload; https://youtu.be/npw9jcQ1h1U
CVE: CVE-2025-36057
Published: 2025-07-21
Description: IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 

is vulnerable to authentication bypass by using the Local Authentication Framework library which is not needed as biometric authentication is not used in the application.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-299
References: https://www.ibm.com/support/pages/node/7239635
CVE: CVE-2025-36062
Published: 2025-07-21
Description: IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 

could be vulnerable to information exposure due to the use of unencrypted network traffic.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311
References: https://www.ibm.com/support/pages/node/7239635
CVE: CVE-2025-36106
Published: 2025-07-21
Description: IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to view and modify information coming to and from the application which could then be used to access confidential information on the device or network by using a the deprecated or misconfigured AFNetworking library at runtime.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://www.ibm.com/support/pages/node/7239635
CVE: CVE-2025-51396
Published: 2025-07-21
Description: A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223; https://github.com/Thewhiteevil/CVE-2025-51396; https://www.dropbox.com/scl/fi/e6z9vidj3wnzm0guzqsax/2025-05-09-02-53-20.mp4?rlkey=s27ywh16uz5uqam0qzweo3p8w&st=eglxeohk&dl=0
CVE: CVE-2025-51397
Published: 2025-07-21
Description: A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-779
References: https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223; https://github.com/Thewhiteevil/CVE-2025-51397; https://www.dropbox.com/scl/fi/qrbtcv8bir2i8ielguyi3/2025-05-09-13-58-50.mp4?rlkey=thcbqxuzpm37o73j0ywsu3h3u&st=fhird68s&dl=0
CVE: CVE-2025-51398
Published: 2025-07-21
Description: A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223; https://github.com/Thewhiteevil/CVE-2025-51398; https://www.dropbox.com/scl/fi/ldtrdf1681gekt9922d4y/2025-05-09-03-09-00.mp4?rlkey=pq1enfkys429h2g3ut3hs4fqj&st=zxc9vuq0&dl=0
CVE: CVE-2025-51400
Published: 2025-07-21
Description: A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223; https://github.com/Thewhiteevil/CVE-2025-51400; https://www.dropbox.com/scl/fi/4ojb61ilgmu4xmtqnfqed/2025-05-08-20-41-52.mp4?rlkey=cz03rl97pskdk7d6bvb9dbvs7&st=ixsqpy0v&dl=0
CVE: CVE-2025-51401
Published: 2025-07-21
Description: A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223; https://github.com/Thewhiteevil/CVE-2025-51401; https://www.dropbox.com/scl/fi/efzjql0brniphfh5sgrzn/2025-05-09-14-26-26.mp4?rlkey=z4zpec6wsja5xo0ovq0g5g1tt&st=abbp3gtr&dl=0
CVE: CVE-2025-51403
Published: 2025-07-21
Description: A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223; https://github.com/Thewhiteevil/CVE-2025-51403; https://www.dropbox.com/scl/fi/w7mur1fo4jb3harpx6om9/2025-05-08-21-38-14.mp4?rlkey=cpf5omg95tikzwno2u99thf3v&st=2xgfedgo&dl=0
CVE: CVE-2025-7934
Published: 2025-07-21
Description: A vulnerability, which was classified as critical, has been found in fuyang_lipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a. This issue affects the function queryPage of the file platform-schedule/src/main/java/com/platform/controller/ScheduleJobController.java. The manipulation of the argument beanName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/fuyang_lipengjun/platform/issues/ICLILS; https://vuldb.com/?ctiid.317063; https://vuldb.com/?id.317063
CVE: CVE-2025-7935
Published: 2025-07-21
Description: A vulnerability, which was classified as critical, was found in fuyang_lipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a. Affected is the function SysLogController of the file platform-admin/src/main/java/com/platform/controller/SysLogController.java. The manipulation of the argument key leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/fuyang_lipengjun/platform/issues/ICLIKX; https://vuldb.com/?ctiid.317064; https://vuldb.com/?id.317064
CVE: CVE-2025-51868
Published: 2025-07-21
Description: Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive information via the conversation_id parameter to the conversation_history endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/Secsys-FDU/CVE-2025-51868
CVE: CVE-2025-51869
Published: 2025-07-21
Description: Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted space_id, thread_id, and message_id parameters to the v1/space/{space_id}/thread/{thread_id}/message/{message_id} endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/Secsys-FDU/CVE-2025-51869
CVE: CVE-2025-52362
Published: 2025-07-21
Description: Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the _proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to submit a specially crafted URL
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://gist.github.com/Shulelk/a18c11866be8609b22ff5df780a42422; https://github.com/PHProxy/phproxy
CVE: CVE-2025-54071
Published: 2025-07-21
Description: RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and below, an authenticated arbitrary file write vulnerability exists in the /api/saves endpoint. This can lead to Remote Code Execution on the system. The vulnerability permits arbitrary file write operations, allowing attackers to create or modify files at any filesystem location with user-supplied content. A user with viewer role or Scope.ASSETS_WRITE permission or above is required to pass authentication checks. The vulnerability is fixed in version 4.0.0-beta.4.
CWE: CWE-434
References: https://github.com/rommapp/romm/commit/89248d03805e5fabca78443dd202ff32e0b4d9f3; https://github.com/rommapp/romm/security/advisories/GHSA-fgxf-hggc-qqmq
CVE: CVE-2025-54121
Published: 2025-07-21
Description: Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/encode/starlette/blob/fa[PII_REDACTED]f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14; https://github.com/encode/starlette/commit/9f7ec2eb512fcc3fe90b43cb9dd9e1d08696bec1; https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403
CVE: CVE-2025-7222
Published: 2025-07-21
Description: Luxion KeyShot 3DM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26473.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.keyshot.com/csirt; https://www.zerodayinitiative.com/advisories/ZDI-25-587/
CVE: CVE-2025-7223
Published: 2025-07-21
Description: INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT HMITool. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25044.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-474/
CVE: CVE-2025-7224
Published: 2025-07-21
Description: INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT HMITool. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25045.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-475/
CVE: CVE-2025-7225
Published: 2025-07-21
Description: INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT HMITool. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25047.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-476/
CVE: CVE-2025-7226
Published: 2025-07-21
Description: INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT HMITool. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25048.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-477/
CVE: CVE-2025-7227
Published: 2025-07-21
Description: INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT VT-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25550.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-478/
CVE: CVE-2025-7228
Published: 2025-07-21
Description: INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT VT-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25571.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-479/
CVE: CVE-2025-7229
Published: 2025-07-21
Description: INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT VT-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25722.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-480/
CVE: CVE-2025-7230
Published: 2025-07-21
Description: INVT VT-Designer PM3 File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT VT-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25723.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.zerodayinitiative.com/advisories/ZDI-25-481/
CVE: CVE-2025-7231
Published: 2025-07-21
Description: INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT VT-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25724.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-482/
CVE: CVE-2025-7233
Published: 2025-07-21
Description: IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26072.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-25-494/
CVE: CVE-2025-7234
Published: 2025-07-21
Description: IrfanView CADImage Plugin CGM File Parsing Out-of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26074.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-495/
CVE: CVE-2025-7235
Published: 2025-07-21
Description: IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26075.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-485/
CVE: CVE-2025-7236
Published: 2025-07-21
Description: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26080.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.zerodayinitiative.com/advisories/ZDI-25-487/
CVE: CVE-2025-7237
Published: 2025-07-21
Description: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26083.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.zerodayinitiative.com/advisories/ZDI-25-504/
CVE: CVE-2025-7238
Published: 2025-07-21
Description: IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26084.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-505/
CVE: CVE-2025-7239
Published: 2025-07-21
Description: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26085.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.zerodayinitiative.com/advisories/ZDI-25-506/