deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54446
Published: 2025-07-23
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54447
Published: 2025-07-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54448
Published: 2025-07-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54449
Published: 2025-07-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54450
Published: 2025-07-23
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54451
Published: 2025-07-23
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54452
Published: 2025-07-23
Description: Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54453
Published: 2025-07-23
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54454
Published: 2025-07-23
Description: Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54455
Published: 2025-07-23
Description: Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-6174
Published: 2025-07-23
Description: The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/ff827f67-712e-4ab6-b6aa-7f5e6ff1283a/; https://wpscan.com/vulnerability/ff827f67-712e-4ab6-b6aa-7f5e6ff1283a/
CVE: CVE-2025-31700
Published: 2025-07-23
Description: A vulnerability has been found in Dahua products.

Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120
References: https://www.dahuasecurity.com/aboutUs/trustedCenter/details/775
CVE: CVE-2025-31701
Published: 2025-07-23
Description: A vulnerability has been found in Dahua products.

Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120
References: https://www.dahuasecurity.com/aboutUs/trustedCenter/details/775
CVE: CVE-2025-8070
Published: 2025-07-23
Description: The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. If the service runs with elevated privileges, exploitation results in privilege escalation to SYSTEM level. This vulnerability arises from an unquoted service path affecting systems where the executable resides in a path containing spaces.
Affected products and versions include: ABP 2.0.7.6130 and earlier as well as AES 1.0.6.6133 and earlier.
CWE: CWE-428
References: https://www.asustor.com/security/security_advisory_detail?id=47
CVE: CVE-2025-41683
Published: 2025-07-23
Description: An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint event_mail_test).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://certvde.com/de/advisories/VDE-2025-052
CVE: CVE-2025-41684
Published: 2025-07-23
Description: An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint tls_iotgen_setting).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://certvde.com/de/advisories/VDE-2025-052
CVE: CVE-2025-41687
Published: 2025-07-23
Description: An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://certvde.com/de/advisories/VDE-2025-052
CVE: CVE-2025-53882
Published: 2025-07-23
Description: A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sent SIGHUP to arbitrary processes. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-807
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53882
CVE: CVE-2025-27930
Published: 2025-07-23
Description: Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2025-27930.html
CVE: CVE-2024-12310
Published: 2025-07-23
Description: A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and allows unauthorized access to the underlying Windows system through the already logged-in autologon account due to insufficient handling of keyboard shortcuts.
This issue affects Imprivata Enterprise Access Management versions 5.3 through 24.2.
CWE: CWE-287
References: https://www.redguard.ch/blog/2025/07/23/cve-2024-12310-imprivata-bypass-of-login-screen/
CVE: CVE-2024-40682
Published: 2025-07-23
Description: IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local user to cause a denial of service due to improper validation of specified type of input.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1287
References: https://www.ibm.com/support/pages/node/7240264
CVE: CVE-2024-40686
Published: 2025-07-23
Description: IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-644
References: https://www.ibm.com/support/pages/node/7240270
CVE: CVE-2024-41750
Published: 2025-07-23
Description: IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-602
References: https://www.ibm.com/support/pages/node/7240264
CVE: CVE-2024-41751
Published: 2025-07-23
Description: IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-602
References: https://www.ibm.com/support/pages/node/7240255
CVE: CVE-2025-4296
Published: 2025-07-23
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing.This issue affects B2B: before 04.06.2025.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://www.usom.gov.tr/bildirim/tr-25-0169
CVE: CVE-2025-50127
Published: 2025-07-23
Description: A SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands.
CWE: CWE-89
References: https://dj-extensions.com/
CVE: CVE-2025-54294
Published: 2025-07-23
Description: A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joomla was discovered. The issue allows unprivileged users to execute arbitrary SQL commands.
CWE: CWE-89
References: https://stackideas.com/
CVE: CVE-2025-54295
Published: 2025-07-23
Description: A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered.
CWE: CWE-79
References: https://dj-extensions.com/
CVE: CVE-2025-54296
Published: 2025-07-23
Description: A stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla was discovered.
CWE: CWE-79
References: https://mooj.org/
CVE: CVE-2025-54297
Published: 2025-07-23
Description: A stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla was discovered.
CWE: CWE-79
References: https://compojoom.com/
CVE: CVE-2025-4411
Published: 2025-07-23
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dataprom Informatics PACS-ACSS allows Cross-Site Scripting (XSS).This issue affects PACS-ACSS: before 16.05.2025.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0171
CVE: CVE-2010-10012
Published: 2025-07-23
Description: A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthenticated attackers to read arbitrary files on the host system. By sending a specially crafted GET request containing a sequence of URL-encoded backslashes and directory traversal patterns, an attacker can escape the web root and access sensitive files outside of the intended directory.
CWE: CWE-22
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/httpdasm_directory_traversal.rb; https://www.exploit-db.com/exploits/15861; https://www.japheth.de/httpdASM.html
CVE: CVE-2015-10141
Published: 2025-07-23
Description: An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.
CWE: CWE-78, CWE-306
References: http://web.archive.org/web/[PII_REDACTED]5418/https://paper.seebug.org/397/; https://kirtixs.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/; https://www.exploit-db.com/exploits/44568
CVE: CVE-2016-15045
Published: 2025-07-23
Description: A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.). In versions 0.9.53-1 (Deepin 15.5) and 0.9.66-1 (Deepin 15.7), the D-Bus configuration permits any user in the sudo group to invoke the InstallPackage method without password authentication. By default, the first user created on Deepin is in the sudo group. An attacker with shell access can craft a .deb package containing a malicious post-install script and use dbus-send to install it via lastore-daemon, resulting in arbitrary code execution as root.
CWE: CWE-269, CWE-306
References: https://github.com/linuxdeepin/lastore-daemon; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/lastore_daemon_dbus_priv_esc.rb; https://www.deepin.org/en/mirrors/releases/
CVE: CVE-2017-20198
Published: 2025-07-23
Description: The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.
CWE: CWE-732
References: https://dcos.io/; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/dcos_marathon.rb; https://web.archive.org/web/[PII_REDACTED]4421/https://warroom.rsmus.com/dcos-marathon-compromise/
CVE: CVE-2018-25113
Published: 2025-07-23
Description: An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter. Successful exploitation can reveal sensitive files accessible by the web server user.
CWE: CWE-22
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/dicoogle_traversal.rb; https://www.exploit-db.com/exploits/45007; https://www.fortiguard.com/encyclopedia/ips/46527/dicoogle-pacs-web-server-directory-traversal
CVE: CVE-2018-25114
Published: 2025-07-23
Description: A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise.
CWE: CWE-94, CWE-434
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/oscommerce_installer_unauth_code_exec.rb; https://www.exploit-db.com/exploits/44374; https://www.oscommerce.com/
CVE: CVE-2022-4978
Published: 2025-07-23
Description: Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom UDP-based control protocol that accepts remote keyboard input events without verification. An attacker on the same network can issue a sequence of keystroke commands to launch a system shell and execute arbitrary commands, resulting in full system compromise.
CWE: CWE-78, CWE-306
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/misc/remote_control_collection_rce.rb; https://remote-control-collection.com/; https://www.vulncheck.com/advisories/steppschuh-remote-control-server-unauth-rce
CVE: CVE-2025-40599
Published: 2025-07-23
Description: An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0014
CVE: CVE-2025-46099
Published: 2025-07-23
Description: In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://pluck.com; https://github.com/0xC4J/CVE-Lists/blob/main/CVE-2025-46099/CVE-2025-46099.md
CVE: CVE-2025-54090
Published: 2025-07-23
Description: A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".



Users are recommended to upgrade to version 2.4.65, which fixes the issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-253
References: https://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2025/07/24/2; https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html
CVE: CVE-2025-33020
Published: 2025-07-23
Description: IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 transmits sensitive information without encryption that could allow an attacker to obtain highly sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311
References: https://www.ibm.com/support/pages/node/7240374
CVE: CVE-2025-33076
Published: 2025-07-23
Description: IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://www.ibm.com/support/pages/node/7240368
CVE: CVE-2025-33077
Published: 2025-07-23
Description: IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://www.ibm.com/support/pages/node/7240375
CVE: CVE-2025-36116
Published: 2025-07-23
Description: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability.  By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that the user is not allowed to perform.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1385
References: https://www.ibm.com/support/pages/node/7240351
CVE: CVE-2025-36117
Published: 2025-07-23
Description: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-384
References: https://www.ibm.com/support/pages/node/7240351
CVE: CVE-2025-40596
Published: 2025-07-23
Description: A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0012
CVE: CVE-2025-40597
Published: 2025-07-23
Description: A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0012
CVE: CVE-2025-40598
Published: 2025-07-23
Description: A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0012; https://labs.watchtowr.com/stack-overflows-heap-overflows-and-existential-dread-sonicwall-sma100-cve-2025-40596-cve-2025-40597-and-cve-2025-40598/
CVE: CVE-2025-6018
Published: 2025-07-23
Description: A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://access.redhat.com/security/cve/CVE-2025-6018; https://bugzilla.redhat.com/show_bug.cgi?id=2372693; https://bugzilla.suse.com/show_bug.cgi?id=1243226
CVE: CVE-2025-2633
Published: 2025-07-23
Description: Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview.html
CVE: CVE-2025-2634
Published: 2025-07-23
Description: Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in fontmgr may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview.html
CVE: CVE-2025-46171
Published: 2025-07-23
Description: vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-400
References: http://vbulletin.com; https://github.com/oiyl/CVE-2025-46171