deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-58632
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dadevarzan Dadevarzan WordPress Common dadevarzan-common allows Stored XSS.This issue affects Dadevarzan WordPress Common: from n/a through <= 2.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dadevarzan-common/vulnerability/wordpress-dadevarzan-wordpress-common-plugin-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58633
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stored XSS.This issue affects Booking Ultra Pro: from n/a through <= 1.1.21.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/booking-ultra-pro/vulnerability/wordpress-booking-ultra-pro-plugin-1-1-21-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58634
Published: 2025-09-03
Description: Missing Authorization vulnerability in peachpay PeachPay Payments peachpay-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PeachPay Payments: from n/a through <= 1.117.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/peachpay-for-woocommerce/vulnerability/wordpress-peachpay-payments-plugin-1-117-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58635
Published: 2025-09-03
Description: Missing Authorization vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.23.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/support-genix-lite/vulnerability/wordpress-support-genix-plugin-1-4-23-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58637
Published: 2025-09-03
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart immonex-kickstart allows PHP Local File Inclusion.This issue affects immonex Kickstart: from n/a through <= 1.11.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/immonex-kickstart/vulnerability/wordpress-immonex-kickstart-plugin-1-11-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-58639
Published: 2025-09-03
Description: Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms mega-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form By Mega Forms: from n/a through <= 1.6.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mega-forms/vulnerability/wordpress-contact-form-by-mega-forms-plugin-1-6-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58640
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Document Engine document-engine allows Stored XSS.This issue affects Document Engine: from n/a through <= 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/document-engine/vulnerability/wordpress-document-engine-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58641
Published: 2025-09-03
Description: Server-Side Request Forgery (SSRF) vulnerability in kamleshyadav Exit Intent Popup exitintentpopup allows Server Side Request Forgery.This issue affects Exit Intent Popup: from n/a through <= 1.0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/exitintentpopup/vulnerability/wordpress-exit-intent-popup-plugin-1-0-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-58642
Published: 2025-09-03
Description: Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Day & Ross Edition ltl-freight-quotes-day-ross-edition allows Object Injection.This issue affects LTL Freight Quotes – Day & Ross Edition: from n/a through <= 2.1.11.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-day-ross-edition/vulnerability/wordpress-ltl-freight-quotes-day-ross-edition-plugin-2-1-11-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58643
Published: 2025-09-03
Description: Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Daylight Edition ltl-freight-quotes-daylight-edition allows Object Injection.This issue affects LTL Freight Quotes – Daylight Edition: from n/a through <= 2.2.7.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-daylight-edition/vulnerability/wordpress-ltl-freight-quotes-daylight-edition-plugin-2-2-7-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58644
Published: 2025-09-03
Description: Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes - TQL Edition ltl-freight-quotes-tql-edition allows Object Injection.This issue affects LTL Freight Quotes - TQL Edition: from n/a through <= 1.2.6.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-tql-edition/vulnerability/wordpress-ltl-freight-quotes-tql-edition-plugin-1-2-6-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-9823
Published: 2025-09-03
Description: SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or escaping, potentially enabling malicious actions such as session hijacking, credential theft, or unauthorized actions in the application.

DetailsThe vulnerability resides in the “Tags” input field on the /s/ajax?action=lead:addLeadTags endpoint. Although the server applies sanitization before storing the data or returning it later, the payload is executed immediately in the victim’s browser upon reflection, allowing an attacker to run arbitrary JavaScript in the user’s session.

ImpactA Reflected XSS attack can have a significant impact, allowing attackers to steal sensitive user data like cookies, redirect users to malicious websites, manipulate the web page content, and essentially take control of a user's session within an application by executing malicious JavaScript code within the victim's browser, even if the server-side code is secure; essentially enabling them to perform actions as if they were the logged-in user.

References  *   Web Security Academy: Cross-site scripting https://portswigger.net/web-security/cross-site-scripting 
  *   Web Security Academy: Reflected cross-site scripting https://portswigger.net/web-security/cross-site-scripting/reflected
CWE: CWE-79
References: https://github.com/mautic/mautic/security/advisories/GHSA-9v8p-m85m-f7mm
CVE: CVE-2025-9824
Published: 2025-09-03
Description: ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.

PatchesThis vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.

Technical DetailsThe vulnerability was caused by different response times when:

  *  A valid username was provided (password hashing occurred)
  *  An invalid username was provided (no password hashing occurred)


The fix introduces a TimingSafeFormLoginAuthenticator that performs a dummy password hash verification even for non-existent users, ensuring consistent timing.

WorkaroundsNo workarounds are available. Users should upgrade to the patched version.

References  *   https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-204
References: https://github.com/mautic/mautic/security/advisories/GHSA-3ggv-qwcp-j6xg
CVE: CVE-2025-0280
Published: 2025-09-03
Description: A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-257
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123627
CVE: CVE-2025-48876
Published: 2025-09-03
Description: Rejected reason: This CVE is a duplicate of another CVE.
CVE: CVE-2025-55852
Published: 2025-09-03
Description: Tenda AC8 v16.03.34.06 is vulnerable to Buffer Overflow in the formWifiBasicSet function via the parameter security or security_5g.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/CyberJ3ff/IOT/blob/main/tenda/tenda%20AC8%20v4%20V16.03.34.06/detail.md
CVE: CVE-2025-55944
Published: 2025-09-03
Description: Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript executes. The issue affects both authenticated and unauthenticated users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/G3XAR/Vulnerability-Research/tree/main/CVE-2025-55944; https://github.com/G3XAR/Vulnerability-Research/tree/main/Slink%20%28up%20to%201.6.3%29/PoC
CVE: CVE-2025-56435
Published: 2025-09-03
Description: SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the operation on the parameter id.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89
References: https://www.yuque.com/g/u43151774/zhyb2o/udq6lsnv80vnhbr4/collaborator/join?token=dU5eQpE4j6zEmVuK&source=doc_collaborator
CVE: CVE-2025-56498
Published: 2025-09-03
Description: An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user input to the /boaform/formPing6 endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can exploit this flaw by injecting arbitrary system commands, which are executed by the underlying operating system with root privileges. The router uses the Boa web server (version 0.93.15) to handle the request. Successful exploitation can lead to full system compromise and unauthorized control of the network device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/Jorge2Rubio/CVEs/blob/main/CVE-2025-56498.md; https://prolink2u.com/products/pgn6401v
CVE: CVE-2025-9919
Published: 2025-09-03
Description: A vulnerability was identified in 1000projects Beauty Parlour Management System 1.0. This affects an unknown function of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ZooNJarway/CVE/issues/3; https://vuldb.com/?ctiid.322320; https://vuldb.com/?id.322320
CVE: CVE-2025-9920
Published: 2025-09-03
Description: A security flaw has been discovered in Campcodes Recruitment Management System 1.0. This impacts the function include of the file /admin/index.php. The manipulation of the argument page results in file inclusion. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-73
References: https://github.com/chenjunjie3/cve/issues/7; https://vuldb.com/?ctiid.322321; https://vuldb.com/?id.322321
CVE: CVE-2025-56689
Published: 2025-09-03
Description: One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying the same response. NOTE: this is disputed by the Supplier because, by design, the product successfully authenticates a client that possesses a cookie whose validity time interval includes the current time, and thus authentication after any type of "interception" is not a violation of the security model. (The cookie has the HttpOnly attribute.)
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-290
References: https://medium.com/@vigneshrajan54_88115/how-i-found-cve-2025-56689-in-safeguard-for-privileged-passwords-6d58fd4bf453
CVE: CVE-2025-56760
Published: 2025-09-03
Description: When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in the name, allowing arbitrary file write on the server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-24
References: https://github.com/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48; https://www.sonarsource.com/blog/securing-go-applications-with-sonarqube-real-world-examples/
CVE: CVE-2025-56761
Published: 2025-09-03
Description: Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/blob/v0.24.0/server/router/api/v1/user_service.go#L147; https://github.com/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48; https://www.sonarsource.com/blog/securing-go-applications-with-sonarqube-real-world-examples/
CVE: CVE-2025-9864
Published: 2025-09-03
Description: Rejected reason: This CVE ID was assigned in error to a vulnerability that was both introduced and fixed before the code landed in the Stable channel of Chrome, and has been withdrawn.
CVE: CVE-2025-9865
Published: 2025-09-03
Description: Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/437147699
CVE: CVE-2025-9866
Published: 2025-09-03
Description: Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-693
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/379337758
CVE: CVE-2025-9867
Published: 2025-09-03
Description: Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/415496161
CVE: CVE-2025-9921
Published: 2025-09-03
Description: A weakness has been identified in code-projects POS Pharmacy System 1.0. Affected is an unknown function of the file /main/products.php. This manipulation of the argument product_code/gen_name/product_name/supplier causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/chen[PII_REDACTED]/CVE/issues/4; https://vuldb.com/?ctiid.322322
CVE: CVE-2025-9922
Published: 2025-09-03
Description: A security vulnerability has been detected in Campcodes Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Such manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/zzb1388/cve/issues/63; https://vuldb.com/?ctiid.322323; https://vuldb.com/?id.322323
CVE: CVE-2025-9959
Published: 2025-09-03
Description: Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents. The attack requires a Prompt Injection in order to trick the agent to create malicious code.
CVSS Score: 7.6 (HIGH)
CWE: CWE-94
References: https://github.com/huggingface/smolagents/pull/1551; https://research.jfrog.com/vulnerabilities/smolagents-local-python-sandbox-escape-jfsa-2[PII_REDACTED]77/
CVE: CVE-2025-20270
Published: 2025-09-03
Description: A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to obtain sensitive information from an affected system.

This vulnerability is due to improper validation of requests to API endpoints. An attacker could exploit this vulnerability by sending a valid request to a specific API endpoint within the affected system. A successful exploit could allow a low-privileged user to view sensitive configuration information on the affected system that should be restricted. To exploit this vulnerability, an attacker must have access as a low-privileged user.&nbsp;&nbsp;
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-info-dis-zhPPMfgz
CVE: CVE-2025-20280
Published: 2025-09-03
Description: A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system.

This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious code into specific data fields in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker must have valid administrative credentials.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-pi-stored-xss-XjQZsyCP
CVE: CVE-2025-20287
Published: 2025-09-03
Description: A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to upload arbitrary files to an affected device.

This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted file upload request to a specific API endpoint. A successful exploit could allow the attacker to upload arbitrary files to an affected system. To exploit this vulnerability, an attacker must have at least valid Config Managers credentials on the affected device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epni-arb-file-upload-jjdM2P83
CVE: CVE-2025-20291
Published: 2025-09-03
Description: A vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user to an untrusted website. Cisco has addressed this vulnerability in the Cisco Webex Meetings service, and no customer action is needed.
 This vulnerability existed because of insufficient validation of URLs that were included in a meeting-join URL. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by including a URL to a website of their choosing in a specific value of a Cisco Webex Meetings join URL. A successful exploit could have allowed the attacker to redirect a targeted user to a website that was controlled by the attacker, possibly making the user more likely to believe the website was trusted by Webex and perform additional actions as part of phishing attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-urlredirect-uK8dDJSZ
CVE: CVE-2025-20326
Published: 2025-09-03
Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device.

This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-csrf-w762pRYd
CVE: CVE-2025-20328
Published: 2025-09-03
Description: A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileges to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. Cisco has addressed this vulnerability in the Cisco Webex Meetings service, and no customer action is needed.
 This vulnerability existed because of insufficient validation of user-supplied input to the user profile component of Cisco Webex Meetings. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could have allowed the attacker to conduct an XSS attack against the targeted user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-55bv8hhm
CVE: CVE-2025-20330
Published: 2025-09-03
Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-xss-XQgu4HSG