deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5492
Published: 2025-06-03
Description: A vulnerability has been found in D-Link DI-500WF-WT up to 20250511 and classified as critical. Affected by this vulnerability is the function sub_456DE8 of the file /msp_info.htm?flag=cmd of the component /usr/sbin/jhttpd. The manipulation of the argument cmd leads to command injection. The attack can be launched remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://vuldb.com/?ctiid.310909; https://vuldb.com/?id.310909; https://vuldb.com/?submit.575244
CVE: CVE-2025-5493
Published: 2025-06-03
Description: A vulnerability was found in Baison Channel Middleware Product 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file /e3api/api/main/ToJsonByControlName. The manipulation of the argument data leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://medium.com/@luoluoxi311/sql-injection-in-baison-channel-middleware-product-version-2-0-1-e0d1ec95c697; https://vuldb.com/?ctiid.310910; https://vuldb.com/?id.310910
CVE: CVE-2025-4205
Published: 2025-06-03
Description: The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.20.4/assets/js/site.js#L869; https://plugins.trac.wordpress.org/changeset/3303770/; https://wordpress.org/plugins/popup-maker/#developers
CVE: CVE-2025-4671
Published: 2025-06-03
Description: The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's user_meta and compare shortcodes in all versions up to, and including, 3.13.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.13.8/admin/advanced-settings/includes/shortcodes/compare.php#L5; https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.13.8/admin/advanced-settings/includes/shortcodes/usermeta.php#L5; https://plugins.trac.wordpress.org/changeset/3304692/
CVE: CVE-2025-5340
Published: 2025-06-03
Description: The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘album_buy_url’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/music-player-for-elementor/tags/2.4.6/classes/widgets/slide-music-player-free.php#L1205; https://plugins.trac.wordpress.org/changeset/3304812/; https://wordpress.org/plugins/music-player-for-elementor/#developers
CVE: CVE-2024-12718
Published: 2025-06-03
Description: Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.

Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.

Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f; https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da; https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9
CVE: CVE-2025-4138
Published: 2025-06-03
Description: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.


You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information.

Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.

Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f; https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da; https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9
CVE: CVE-2025-4330
Published: 2025-06-03
Description: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.


You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information.

Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.

Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f; https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da; https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9
CVE: CVE-2025-4435
Published: 2025-06-03
Description: When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.
CVSS Score: 7.5 (HIGH)
CWE: CWE-682
References: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da; https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9; https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a
CVE: CVE-2025-4517
Published: 2025-06-03
Description: Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data".


You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information.

Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.

Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-22
References: https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f; https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da; https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9
CVE: CVE-2025-5495
Published: 2025-06-03
Description: A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. The manipulation with the input %00currentsetting.htm leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This issue appears to have been circulating as an 0day since 2024.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/WNR614/ACL%20bypass%20Vulnerability%20in%20Netgear%20WNR614.md; https://vuldb.com/?ctiid.310911; https://vuldb.com/?id.310911
CVE: CVE-2025-5497
Published: 2025-06-03
Description: A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to resolve this issue. The patch is named 41a72eca0baa9d9d0214fec97db2400bc082d2a9. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/3em0/cve_repo/blob/main/phpwcms/phar%20vulnerability%20in%20phpwcms.md; https://github.com/slackero/phpwcms/commit/41a72eca0baa9d9d0214fec97db2400bc082d2a9; https://github.com/slackero/phpwcms/releases/tag/v1.10.9
CVE: CVE-2025-45855
Published: 2025-06-03
Description: An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://gist.github.com/Cafe-Tea/b72d442be434e1dafe7810c938892b06; https://github.com/erupts/erupt; https://www.erupt.xyz/#%21/
CVE: CVE-2025-46154
Published: 2025-06-03
Description: Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.
CVSS Score: 8.4 (HIGH)
CWE: CWE-89
References: https://github.com/Yf3te/CVE/blob/main/CVE-2025-46154
CVE: CVE-2025-5498
Published: 2025-06-03
Description: A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of the file include/inc_lib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpage_custom leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/3em0/cve_repo/blob/main/phpwcms/cnt21.readform.inc.php%23file_get_contents.md; https://github.com/3em0/cve_repo/blob/main/phpwcms/cnt21.readform.inc.php%23is_file.md; https://github.com/slackero/phpwcms/releases/tag/v1.10.9
CVE: CVE-2025-5499
Published: 2025-06-03
Description: A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/3em0/cve_repo/blob/main/phpwcms/image_resized%23getimagesize.md; https://github.com/slackero/phpwcms/releases/tag/v1.10.9; https://vuldb.com/?ctiid.310914
CVE: CVE-2025-5501
Published: 2025-06-03
Description: A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_handle_path_switch_request_transfer of the file src/smf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to reachable assertion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 2daa44adab762c47a8cef69cc984946973a845b3. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://github.com/open5gs/open5gs/commit/2daa44adab762c47a8cef69cc984946973a845b3; https://github.com/open5gs/open5gs/issues/3909; https://github.com/open5gs/open5gs/issues/3909#issuecomment[PII_REDACTED]
CVE: CVE-2025-5502
Published: 2025-06-03
Description: A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. Affected by this issue is the function formMapReboot of the file /boafrm/formMapReboot. The manipulation of the argument deviceMacAddr leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-787
References: https://github.com/Yhuanhuan01/TOTOlink/blob/main/TOTOlink-x15.md#poc1-code-injection; https://vuldb.com/?ctiid.310916; https://vuldb.com/?id.310916
CVE: CVE-2024-45655
Published: 2025-06-03
Description: IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://www.ibm.com/support/pages/node/7235378
CVE: CVE-2025-36564
Published: 2025-06-03
Description: Dell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-61, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000325203/dsa-2025-224
CVE: CVE-2025-43923
Published: 2025-06-03
Description: An issue was discovered in ReportController in Unicom Focal Point 7.6.1. A user who has administrative privilege in Focal Point can perform SQL injection via the image parameter during a delete report image operation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.unicomsi.com/products/focal-point/; https://www.unicomsi.com/security-advisory/
CVE: CVE-2025-43924
Published: 2025-06-03
Description: Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController (for /fp/admin/settings/loginpage) and the rootserviceurl parameter in FriendsController (for /fp/admin/settings/friends), entered by an admin, allow stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.unicomsi.com/products/focal-point/; https://www.unicomsi.com/security-advisory/
CVE: CVE-2025-43925
Published: 2025-06-03
Description: An issue was discovered in Unicom Focal Point 7.6.1. The database is encrypted with a hardcoded key, making it easier to recover the cleartext data.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-326
References: https://www.unicomsi.com/products/focal-point/; https://www.unicomsi.com/security-advisory/
CVE: CVE-2025-46548
Published: 2025-06-03
Description: If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied.


Users that rely on authentication instead of making sure the Management API ports are only available to trusted users are recommended to upgrade to version 1.1.1, which fixes this issue.




Akka was affected by the same issue and has released the fix in version 1.6.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://github.com/akka/akka-management/pull/1385; https://github.com/apache/pekko-management/pull/418; https://lists.apache.org/thread/tnd84hj9w0ggjcft6cp12q67d5jzhp66
CVE: CVE-2025-5503
Published: 2025-06-03
Description: A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. This affects the function formMapReboot of the file /boafrm/formMapReboot. The manipulation of the argument deviceMacAddr leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/Yhuanhuan01/TOTOlink/blob/main/TOTOlink-x15.md#poc2-stack_overflow; https://vuldb.com/?ctiid.310917; https://vuldb.com/?id.310917
CVE: CVE-2025-5504
Published: 2025-06-03
Description: A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20[PII_REDACTED] and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWsc. The manipulation of the argument peerRptPin leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/fizz-is-on-the-way/Iot_vuls/blob/main/X2000R/RCE_formWsc/RCE_formWsc.md; https://vuldb.com/?ctiid.310918; https://vuldb.com/?id.310918
CVE: CVE-2025-5505
Published: 2025-06-03
Description: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20[PII_REDACTED] and classified as problematic. This issue affects some unknown processing of the file /boafrm/formPortFw of the component Virtual Server Page. The manipulation of the argument service_type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_virtual_server; https://vuldb.com/?ctiid.310919; https://vuldb.com/?id.310919
CVE: CVE-2025-5506
Published: 2025-06-03
Description: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20[PII_REDACTED]. It has been classified as problematic. Affected is an unknown function of the component NAT Mapping Page. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_Nat_Mapping; https://vuldb.com/?ctiid.310920; https://vuldb.com/?id.310920
CVE: CVE-2025-1334
Published: 2025-06-03
Description: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 allows web pages to be stored locally which can be read by another user on the system.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-525
References: https://www.ibm.com/support/pages/node/7235432
CVE: CVE-2025-23103
Published: 2025-06-03
Description: An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23103/
CVE: CVE-2025-25019
Published: 2025-06-03
Description: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-613
References: https://www.ibm.com/support/pages/node/7235432
CVE: CVE-2025-25020
Published: 2025-06-03
Description: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated user to cause a denial of service due to improperly validating API data input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://www.ibm.com/support/pages/node/7235432
CVE: CVE-2025-25021
Published: 2025-06-03
Description: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a privileged execute code in case management script creation due to the improper generation of code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://www.ibm.com/support/pages/node/7235432
CVE: CVE-2025-25022
Published: 2025-06-03
Description: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the environment to obtain highly sensitive information in configuration files.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-260
References: https://www.ibm.com/support/pages/node/7235432
CVE: CVE-2025-44148
Published: 2025-06-03
Description: Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: http://mailenable.com; https://github.com/barisbaydur/CVE-2025-44148
CVE: CVE-2025-45854
Published: 2025-06-03
Description: /server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-862
References: https://gist.github.com/Cafe-Tea/bc14b38f4bfd951de2979a24c3358460; https://gitee.com/jehc/JEHC-BPM; https://web.archive.org/web/[PII_REDACTED]4020/https://gist.github.com/Cafe-Tea/bc14b38f4bfd951de2979a24c3358460/revisions