deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12878
Published: 2025-11-19
Description: The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wfop_phone` shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output escaping on the user-supplied `default` attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.2/modules/optins/merge-tags/class-bwf-optin-tags.php#L101; https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.2/modules/optins/merge-tags/class-bwf-optin-tags.php#L116; https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.2/modules/optins/merge-tags/class-bwf-optin-tags.php#L30
CVE: CVE-2025-13054
Published: 2025-11-19
Description: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to, and including, 3.14.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3397155/profile-builder; https://www.wordfence.com/threat-intel/vulnerabilities/id/3830ae19-cafc-40db-afde-2424cae23031?source=cve
CVE: CVE-2025-13145
Published: 2025-11-19
Description: The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV file imports in the import_single_post_as_csv function within SingleImportExport.php. This makes it possible for authenticated attackers, with administrator-level access or higher, to inject a PHP object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/trunk/SingleImportExport.php#L116; https://plugins.trac.wordpress.org/changeset/3397842/wp-ultimate-csv-importer/trunk/SingleImportExport.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/5e441699-4c78-4277-8ac1-f33b810e78cb?source=cve
CVE: CVE-2025-11243
Published: 2025-11-19
Description: Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM (before v1.6) allows Excessive Allocation via network.
CWE: CWE-770
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-02; https://www.nozominetworks.com/blog/shelly-pro-4pm-vulnerabilities; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11243
CVE: CVE-2025-12056
Published: 2025-11-19
Description: Out-of-bounds Read in Shelly Pro 3EM (before v1.4.4) allows Overread Buffers.
CWE: CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-03; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-12056
CVE: CVE-2025-12535
Published: 2025-11-19
Description: The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1. This is due to the plugin distributing generic WordPress REST API nonces (wp_rest) to unauthenticated users via the 'wp_ajax_nopriv_rest-nonce' action. While the plugin legitimately needs to support unauthenticated form submissions, it incorrectly uses generic REST nonces instead of form-specific nonces. This makes it possible for unauthenticated attackers to bypass CSRF protection on REST API endpoints that rely solely on nonce verification without additional authentication checks, allowing them to trigger unauthorized actions such as the plugin's own post-submission hooks and potentially other plugins' REST endpoints.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/admin-ajax.php#L45; https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/background-process.php#L74; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391762%40sureforms%2Ftrunk&old=3382423%40sureforms%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2025-13085
Published: 2025-11-19
Description: The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the resolve_variables() AJAX handler. This makes it possible for authenticated attackers with the siteseo_manage capability (e.g., Author-level users who have been granted SiteSEO access by an administrator) to read arbitrary post metadata from any post, page, attachment, or WooCommerce order they cannot edit, via the custom field variable resolution feature granted they have been given access to SiteSEO by an administrator and legacy storage is enabled. In affected WooCommerce installations, this exposes sensitive customer billing information including names, email addresses, phone numbers, physical addresses, and payment methods.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/admin.php#L106; https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/ajax.php#L542; https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/titlesmetas.php#L494
CVE: CVE-2025-12484
Published: 2025-11-19
Description: The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple social media username parameters in all versions up to, and including, 1.12.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/entry.php#L110; https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/rafflepress.php#L539; https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/rafflepress.php#L543
CVE: CVE-2025-13035
Published: 2025-11-19
Description: The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the plugin's use of extract() on attacker-controlled shortcode attributes within the `evaluate_shortcode_from_flat_file` method, which can be used to overwrite the `$filepath` variable and subsequently passed to require_once. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server via the `[code_snippet]` shortcode using PHP filter chains granted they can trick an administrator into enabling the "Enable file-based execution" setting and creating at least one active Content snippet.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.8.1/php/front-end/class-front-end.php#L295; https://plugins.trac.wordpress.org/browser/code-snippets/tags/3.8.1/php/front-end/class-front-end.php#L296; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3397635%40code-snippets%2Ftrunk&old=3395415%40code-snippets%2Ftrunk&sfp_email=&sfph_mail=#file23
CVE: CVE-2025-13206
Published: 2025-11-19
Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Avatars must be enabled in the WordPress install in order to exploit the vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/give/tags/4.11.0/includes/class-give-donor.php#L1135; https://plugins.trac.wordpress.org/browser/give/tags/4.11.0/includes/process-donation.php#L1230; https://plugins.trac.wordpress.org/browser/give/tags/4.11.0/templates/shortcode-donor-wall.php#L59
CVE: CVE-2025-11446
Published: 2025-11-19
Description: Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.2.0 before 5.2.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://support.upkeeper.se/hc/en-us/articles/[PII_REDACTED]0076-CVE-2025-11446-Insertion-of-Sensitive-Information-into-Log-File
CVE: CVE-2025-0351
Published: 2025-11-19
Description: Rejected reason: Voluntarily withdrawn
CVE: CVE-2025-11230
Published: 2025-11-19
Description: Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-407
References: https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability
CVE: CVE-2025-58412
Published: 2025-11-19
Description: A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-80
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-736
CVE: CVE-2025-12472
Published: 2025-11-19
Description: An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance.



Looker-hosted and Self-hosted were found to be vulnerable.
This issue has already been mitigated for Looker-hosted instances. No user action is required for these.


Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page  https://download.looker.com/ :
  *  24.12.103+
  *  24.18.195+
  *  25.0.72+
  *  25.6.60+
  *  25.8.42+
  *  25.10.22+
CWE: CWE-362
References: https://cloud.google.com/support/bulletins#gcp-2025-052
CVE: CVE-2025-13395
Published: 2025-11-19
Description: A security flaw has been discovered in codehub666 94list up to 5831c8240e99a72b7d3508c79ef46ae4b96befe8. The impacted element is the function Login of the file /function.php. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/codehub666/94list/issues/63; https://github.com/codehub666/94list/issues/63#issue[PII_REDACTED]; https://vuldb.com/?ctiid.332923
CVE: CVE-2025-64408
Published: 2025-11-19
Description: Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. 

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b; http://www.openwall.com/lists/oss-security/2025/11/19/1
CVE: CVE-2025-10437
Published: 2025-11-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection.This issue affects Webpack Management System: through 20251119.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0401
CVE: CVE-2025-12592
Published: 2025-11-19
Description: Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.
CWE: CWE-1392
References: http://www.vapidlabs.com/advisory.php?v=219; https://www.akamai.com/blog/security-research/rce-zero-day-in-legacy-vivotek-firmware
CVE: CVE-2024-8527
Published: 2025-11-19
Description: Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.
CWE: CWE-601
References: https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2024-8528
Published: 2025-11-19
Description: Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized.
CWE: CWE-79
References: https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2025-0421
Published: 2025-11-19
Description: Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.This issue affects Shopside: through 05022025.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1021
References: https://www.usom.gov.tr/bildirim/tr-25-0402
CVE: CVE-2025-11963
Published: 2025-11-19
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities allows Reflected XSS.This issue affects StarCities: before 1.1.61.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0403
CVE: CVE-2025-63218
Published: 2025-11-19
Description: The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-285
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63218_Axel%20Technology%20WOLF1MS%20and%20WOLF2MS%20-%20Broken%20Access%20Control; https://www.axeltechnology.com/
CVE: CVE-2025-63219
Published: 2025-11-19
Description: The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServer 2.0) is vulnerable to session hijacking due to improper session management on the /home.html endpoint. An attacker can access an active session without authentication, allowing them to control the device, modify configurations, and compromise system integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63219_ITEL%20ISO%20FM%20SFN%20Adapter%20-%20Session%20Hijacking; https://www.itel.it/
CVE: CVE-2025-63243
Published: 2025-11-19
Description: A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01). The sle_sSenha parameter to the loginAlterarSenha.asp file. An attacker can craft a malicious URL that, when visited by a victim, causes arbitrary JavaScript code to be executed in the victim's browser within the security context of the vulnerable application. This issue could allow attackers to steal session cookies, disclose sensitive information, perform unauthorized actions on behalf of the user, or conduct phishing attacks.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://medium.com/@wagneralves_87750/cve-2025-63243-reflected-cross-site-scripting-in-loginalterarsenha-asp-via-sle-slogin-parameter-53808fbbeeee; https://www.pixeon.com/
CVE: CVE-2025-13396
Published: 2025-11-19
Description: A weakness has been identified in code-projects Courier Management System 1.0. This affects an unknown function of the file /add-office.php. This manipulation of the argument OfficeName causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/beamyou/CVE/issues/1; https://vuldb.com/?ctiid.332924
CVE: CVE-2025-13397
Published: 2025-11-19
Description: A security vulnerability has been detected in mrubyc up to 3.4. This impacts the function mrbc_raw_realloc of the file src/alloc.c. Such manipulation of the argument ptr leads to null pointer dereference. An attack has to be approached locally. The name of the patch is[PII_REDACTED]07b[PII_REDACTED]bf45297c3da8f1c87. It is advisable to implement a patch to correct this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476
References: https://github.com/mrubyc/mrubyc/commit/[PII_REDACTED]07b[PII_REDACTED]bf45297c3da8f1c87; https://github.com/mrubyc/mrubyc/issues/244; https://github.com/mrubyc/mrubyc/issues/244#issuecomment[PII_REDACTED]
CVE: CVE-2025-63220
Published: 2025-11-19
Description: The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fails to validate the integrity of manual.sh, allowing an attacker to inject arbitrary commands by modifying this script and repackaging the firmware.
CVSS Score: 7.2 (HIGH)
CWE: CWE-494
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63220_Sound4%20FIRST%20RCE; https://www.sound4helpdesk.com/; https://www.sound4helpdesk.com/first-downloads/
CVE: CVE-2025-63221
Published: 2025-11-19
Description: The Axel Technology puma devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63221_Axel%20Technology%20puma%20-%20Broken%20Access%20Control; https://www.axeltechnology.com/
CVE: CVE-2025-63223
Published: 2025-11-19
Description: The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63223_Axel%20Technology%20StreamerMAX%20MK%20II%20-%20Broken%20Access%20Control; https://www.axeltechnology.com/; https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63223_Axel%20Technology%20StreamerMAX%20MK%20II%20-%20Broken%20Access%20Control
CVE: CVE-2025-63224
Published: 2025-11-19
Description: The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287, CWE-384
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63224_Itel%20DAB%20Encoder%20Authentication%20Bypass; https://www.itel.it/
CVE: CVE-2025-63878
Published: 2025-11-19
Description: Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/rumanaemu/CVE-Research/blob/main/CVE-2025-63878.md; https://www.linkedin.com/in/rumana-khatun-208aa731b/
CVE: CVE-2025-63879
Published: 2025-11-19
Description: A reflected cross-site scripted (XSS) vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rumanaemu/CVE-Research/blob/main/CVE-2025-63879.md; https://www.linkedin.com/in/rumana-khatun-208aa731b/
CVE: CVE-2025-65022
Published: 2025-11-19
Description: i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda request parameter, which is directly concatenated into multiple SQL queries without proper sanitization. This issue has been patched in commit b473f92.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/portabilis/i-educar/commit/b473f92b5326f45d7bce2de93a5381bed7ca8ac7; https://github.com/portabilis/i-educar/security/advisories/GHSA-4hrj-5gwx-r4w4
CVE: CVE-2025-65023
Published: 2025-11-19
Description: i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/funcionario_vinculo_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_funcionario_vinculo GET parameter, which is directly concatenated into an SQL query without proper sanitization. This issue has been patched in commit a00dfa3.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/portabilis/i-educar/commit/a00dfa3f129bc84e27873aa01cbd3f82e5b6c6c8; https://github.com/portabilis/i-educar/security/advisories/GHSA-8rv6-x8h9-fjfc; https://github.com/portabilis/i-educar/security/advisories/GHSA-8rv6-x8h9-fjfc
CVE: CVE-2025-65024
Published: 2025-11-19
Description: i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda_admin_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda GET parameter, which is directly concatenated into an SQL query without proper sanitization. This issue has been patched in commit 3e9763a.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/portabilis/i-educar/commit/3e9763a561b328edaed21a7dc2e0dba0bbbc6e22; https://github.com/portabilis/i-educar/security/advisories/GHSA-6c8p-xqcv-rghx