deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-32929
Published: 2025-04-15
Description: Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Barcode Generator for WooCommerce: from n/a through <= 2.0.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/embedding-barcodes-into-product-pages-and-orders/vulnerability/wordpress-barcode-generator-for-woocommerce-plugin-2-0-4-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-32102
Published: 2025-04-15
Description: CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://packetstorm.news/files/id/190460/; https://seclists.org/fulldisclosure/2025/Apr/17; https://www.crushftp.com/
CVE: CVE-2025-32103
Published: 2025-04-15
Description: CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-40, CWE-22
References: https://packetstorm.news/files/id/190460/; https://seclists.org/fulldisclosure/2025/Apr/17; https://www.crushftp.com/
CVE: CVE-2025-32944
Published: 2025-04-15
Description: The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner.  If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248
References: https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1; https://research.jfrog.com/vulnerabilities/peertube-archive-persistent-dos/
CVE: CVE-2025-32945
Published: 2025-04-15
Description: The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-282
References: https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1; https://research.jfrog.com/vulnerabilities/peertube-arbitrary-playlist-creation-rest/
CVE: CVE-2025-32946
Published: 2025-04-15
Description: This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-282
References: https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1; https://research.jfrog.com/vulnerabilities/peertube-arbitrary-playlist-creation-activitypub/
CVE: CVE-2025-3608
Published: 2025-04-15
Description: A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1951554; https://www.cve.org/CVERecord?id=CVE-2025-3608; https://www.mozilla.org/security/advisories/mfsa2025-25/
CVE: CVE-2025-28136
Published: 2025-04-15
Description: TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28136.md; https://sudsy-eyeliner-a59.notion.site/BufferOverflow-V4-1-2cu-5137_B20[PII_REDACTED]2b8cd95f80cf8df9f3abcb912554
CVE: CVE-2025-28137
Published: 2025-04-15
Description: The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28137.md; https://sudsy-eyeliner-a59.notion.site/RCE1-1ab72b8cd95f80d09eded269810f3756?pvs=4; https://sudsy-eyeliner-a59.notion.site/RCE1-1ab72b8cd95f80d09eded269810f3756
CVE: CVE-2025-29280
Published: 2025-04-15
Description: Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cray0nLee/CVE/issues/1; https://github.com/Cray0nLee/CVE/issues/1
CVE: CVE-2025-27980
Published: 2025-04-15
Description: cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://blog.csdn.net/qq_52469895/article/details/145496958?sharetype=blogdetail&sharerId=145496958&sharerefer=PC&sharesource=qq_52469895&spm=1011.2480.3001.8118
CVE: CVE-2025-28142
Published: 2025-04-15
Description: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/formDiskCreateShare.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/regainer27/fb033d40b9d0245c36e520eeb34b7e76; https://github.com/regainer27/edimax-br-6478ac_v3-br-6478ac_v3_1.0.15/tree/main/4
CVE: CVE-2025-28143
Published: 2025-04-15
Description: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/formDiskCreateGroup.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/regainer27/885505cda80f81069ba39b11f2f996fc; https://github.com/regainer27/edimax-br-6478ac_v3-br-6478ac_v3_1.0.15/tree/main/5
CVE: CVE-2025-28144
Published: 2025-04-15
Description: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://gist.github.com/regainer27/31a4df78e[PII_REDACTED]08ddd4b68d91f; https://github.com/regainer27/edimax-br-6478ac_v3-br-6478ac_v3_1.0.15/tree/main/edimax_br-6847_v3-%20peerpin_stack_overflow
CVE: CVE-2025-28145
Published: 2025-04-15
Description: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDiskFormat.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/regainer27/cee49ede0f576447cc4b1bb078e7a981; https://github.com/regainer27/edimax-br-6478ac_v3-br-6478ac_v3_1.0.15/tree/main/2
CVE: CVE-2025-29281
Published: 2025-04-15
Description: In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/Cray0nLee/CVE/issues/2
CVE: CVE-2025-2830
Published: 2025-04-15
Description: By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1956379; https://www.mozilla.org/security/advisories/mfsa2025-26/; https://www.mozilla.org/security/advisories/mfsa2025-27/
CVE: CVE-2025-32947
Published: 2025-04-15
Description: This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/Chocobozzz/PeerTube/commit/76226d85685220db[PII_REDACTED]eca784d0336f7d; https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1; https://research.jfrog.com/vulnerabilities/peertube-activitypub-crawl-dos/
CVE: CVE-2025-32948
Published: 2025-04-15
Description: The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1; https://research.jfrog.com/vulnerabilities/peertube-activitypub-playlist-creation-blind-ssrf-dos/
CVE: CVE-2025-32949
Published: 2025-04-15
Description: This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb. 

If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. The yauzl library does not contain any mechanism to detect or prevent extraction of a  Zip Bomb https://en.wikipedia.org/wiki/Zip_bomb . Therefore, when using the User Import functionality with a Zip Bomb, PeerTube will try extracting the archive which will cause a disk space resource exhaustion.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-409
References: https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1; https://research.jfrog.com/vulnerabilities/peertube-archive-resource-exhaustion/
CVE: CVE-2025-3522
Published: 2025-04-15
Description: Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to  determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1955372; https://www.mozilla.org/security/advisories/mfsa2025-26/; https://www.mozilla.org/security/advisories/mfsa2025-27/
CVE: CVE-2025-3523
Published: 2025-04-15
Description: When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1958385; https://www.mozilla.org/security/advisories/mfsa2025-26/; https://www.mozilla.org/security/advisories/mfsa2025-27/
CVE: CVE-2020-18243
Published: 2025-04-15
Description: SQL injection vulnerability found in Enricozab CMS v.1.0 allows a remote attacker to execute arbitrary code via /hdo/hdo-view-case.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/enricozab/CMS/issues/1
CVE: CVE-2024-11084
Published: 2025-04-15
Description: Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists.
CWE: CWE-203
References: https://portal.perforce.com/s/detail/a91PA000001SeWbYAK
CVE: CVE-2024-13177
Published: 2025-04-15
Description: Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A standard user could potentially create a symlink of the file “nsinstallation” to escalate the privileges of a different file on the system. 
This issue affects Netskope Client: before 123.0, before 117.1.11.2310, before 120.1.10.2306.
CWE: CWE-610
References: https://support.netskope.com/s/article/Netskope-Security-Advisory-Netskope-Client-installer-with-symbolic-link-following-vulnerability-leading-to-privilege-escalation
CVE: CVE-2024-36842
Published: 2025-04-15
Description: An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Number PlatformVER:K24-2023/05/09-v0.01 allows a remote attacker to execute arbitrary code via the ADB port component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://github.com/abbiy/Backdooring-Oncord-Android-Sterio-/blob/main/README.md
CVE: CVE-2025-24948
Published: 2025-04-15
Description: In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-598
References: https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2025-24949
Published: 2025-04-15
Description: In JotUrl 2.0, is possible to bypass security requirements during the password change process.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2025-28198
Published: 2025-04-15
Description: A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/Hitout/carsale/issues/24
CVE: CVE-2025-32911
Published: 2025-04-15
Description: A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-590
References: https://access.redhat.com/errata/RHSA-2025:21657; https://access.redhat.com/errata/RHSA-2025:4439; https://access.redhat.com/errata/RHSA-2025:4440
CVE: CVE-2025-29817
Published: 2025-04-15
Description: Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-427
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29817
CVE: CVE-2025-32776
Published: 2025-04-15
Description: OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the `matrix_custom_frame` file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/openrazer/openrazer/commit/57610511d2548eda66999eaed5aa4517e89d6d39; https://github.com/openrazer/openrazer/commit/d869abd20995b4931795e1cde54d4ac84d9ca62f; https://github.com/openrazer/openrazer/issues/2433
CVE: CVE-2025-32779
Published: 2025-04-15
Description: E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with access to the `/backup/import` API endpoint can write arbitrary files to locations outside the intended extraction directory due to a Zip Slip vulnerability. Although the application runs as a non-root user (`185`), limiting direct impact on system-level files, this vulnerability can still be exploited to overwrite application files (e.g., JAR libraries) owned by the application user. This overwrite can potentially lead to Remote Code Execution (RCE) within the application's context. This issue has been patched in version 5.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/labsai/EDDI/commit/1e207d0e4f72a5a93920bc0f76cad53ffd8e7065; https://github.com/labsai/EDDI/security/advisories/GHSA-9v34-frgq-63mv; https://www.sonarsource.com/blog/code-security-for-conversational-ai-uncovering-a-zip-slip-in-eddi
CVE: CVE-2025-32780
Published: 2025-04-15
Description: BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerable to a DLL Hijacking vulnerability. By placing a malicious DLL with the name uuid.dll in the folder C:\Users\<username>\AppData\Local\Microsoft\WindowsApps\, an attacker can execute arbitrary code every time BleachBit is run. This issue has been patched in version 4.9.0.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://github.com/bleachbit/bleachbit/commit/dafeba57dcb14c7ec4a97224ff1408f6b0c2a7f8; https://github.com/bleachbit/bleachbit/security/advisories/GHSA-ghph-v4x4-vr3c
CVE: CVE-2021-27289
Published: 2025-04-15
Description: A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12), where the Zigbee anti-replay mechanism - based on the frame counter field - is improperly implemented. As a result, an attacker within wireless range can resend captured packets with a higher sequence number, which the devices incorrectly accept as legitimate messages. This allows spoofed commands to be injected without authentication, triggering false alerts and misleading the user through notifications in the mobile application used to monitor the network.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-294
References: https://github.com/TheMalwareGuardian/CVE-2021-27289; https://packetstormsecurity.com/files/160331/Ksix-Zigbee-Devices-Playback-Protection-Bypass.html; https://www.exploit-db.com/exploits/49169
CVE: CVE-2024-42189
Published: 2025-04-15
Description: HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120585
CVE: CVE-2024-42200
Published: 2025-04-15
Description: HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120585
CVE: CVE-2024-50960
Published: 2025-04-15
Description: A command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 <=3.01, SMP 351 <=2.16, SMP 352 <= 2.16, and SME 211 <= 3.02, allows a remote authenticated attacker to execute arbitrary commands as root on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/layer8secure/extron-smp-inject/; https://ryanmroth.com/articles/exploiting-extron-smp-command-injection; https://www.extron.com/article/smp
CVE: CVE-2025-28100
Published: 2025-04-15
Description: A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at the "operateOrder.php" id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/gh3-dk/vul/blob/main/sql%20injection/dingfanzu/dingfanzu-CMS%20operateOrder.php%20id%20SQL-inject.md
CVE: CVE-2025-29705
Published: 2025-04-15
Description: code-gen <=2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission control allowing anyone to access such projects.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://gitee.com/durcframework/code-gen; https://github.com/yxzrw/CVE-2025-29705
CVE: CVE-2025-33026
Published: 2025-04-15
Description: In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, PeaZip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-830, CWE-829
References: https://github.com/EnisAksu/Argonis/blob/main/CVEs/CVE-2025-33026%20%28PeaZip%29/CVE-2025-33026.md; https://peazip.github.io/peazip-64bit.html; https://github.com/EnisAksu/Argonis/blob/main/CVEs/CVE-2025-33026%20%28PeaZip%29/CVE-2025-33026.md
CVE: CVE-2025-33027
Published: 2025-04-15
Description: In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Bandizip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, Bandizip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-830, CWE-829
References: https://en.bandisoft.com/bandizip/; https://github.com/EnisAksu/Argonis/blob/main/CVEs/CVE-2025-33027%20%28Bandizip%29/CVE-2025-33027.md; https://github.com/EnisAksu/Argonis/blob/main/CVEs/CVE-2025-33027%20%28Bandizip%29/CVE-2025-33027.md