exploitintel/cve-cwe-consensus huggingface dataset:
user: Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.

assistant: CWE-269
user: There is a configuration defect vulnerability in ZTELink 5.4.9 for iOS. This vulnerability is caused by a flaw in the WiFi parameter configuration of the ZTELink. An attacker can obtain unauthorized access to the WiFi service.

assistant: CWE-327
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Candid themes Grip.This issue affects Grip: from n/a through 1.0.9.

assistant: CWE-706, CWE-829
user: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Graham Quick Interest Slider quick-interest-slider allows DOM-Based XSS.This issue affects Quick Interest Slider: from n/a through <= 3.1.5.

assistant: CWE-79
user: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSTheme RS Elements Elementor Addon rselements-lite allows Stored XSS.This issue affects RS Elements Elementor Addon: from n/a through <= 1.1.5.

assistant: CWE-79
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FULL SERVICES FULL Customer full-customer allows PHP Local File Inclusion.This issue affects FULL Customer: from n/a through <= 3.1.26.

assistant: CWE-706, CWE-829
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Calculator Builder calculator-builder allows PHP Local File Inclusion.This issue affects Calculator Builder: from n/a through <= 1.6.2.

assistant: CWE-706, CWE-829
user: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.5.

assistant: CWE-79
user: Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.94.0.

assistant: CWE-502
user: Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: from n/a through 3.3.3.

assistant: CWE-434
user: StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.

assistant: CWE-639
user: An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment.

assistant: CWE-94
user: The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the "vulnerable systems are not following manufacturers' recommendations to change the default password."

assistant: CWE-287
user: Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

assistant: CWE-89
user: There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules.

assistant: CWE-287
user: The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.

assistant: CWE-863
user: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-20617.

assistant: CWE-78
user: Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).

assistant: CWE-639
user: RemoteView PC Application Console versions prior to 6.0.2 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution.

assistant: CWE-427
user: Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.

assistant: CWE-307
user: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.  

It's a regression between 18.12.17 and 18.12.18.
In case you use something like that, which is not recommended!
For security, only official releases should be used.

In other words, if you use 18.12.17 you are still safe.
The version 18.12.17 is not a affected.
But something between 18.12.17 and 18.12.18 is.

In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.

assistant: CWE-94
user: A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks.




Users are recommended to upgrade to version 1.7.0, which fixes the issue.

assistant: CWE-502
user: Missing Authorization vulnerability in Themes4WP Bulk allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk: from n/a through 1.0.11.

assistant: CWE-862
user: Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3.

assistant: CWE-862
user: Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Eximius allows Using Malicious Files.This issue affects Eximius: from n/a through 2.2.

assistant: CWE-434
user: Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

assistant: CWE-502
user: Deserialization of Untrusted Data vulnerability in Beaver Builder WordPress Assistant assistant allows Object Injection.This issue affects WordPress Assistant: from n/a through <= 1.5.1.

assistant: CWE-502
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hockeydata hockeydata LOS hockeydata-los allows PHP Local File Inclusion.This issue affects hockeydata LOS: from n/a through <= 1.2.4.

assistant: CWE-706, CWE-829
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through <= 1.3.6.4.

assistant: CWE-706, CWE-829
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mobeen Abdullah Coming Soon, Maintenance Mode site-mode allows PHP Local File Inclusion.This issue affects Coming Soon, Maintenance Mode: from n/a through <= 1.1.1.

assistant: CWE-706, CWE-829
user: Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue affects Flexmls® IDX: from n/a through <= 3.14.27.

assistant: CWE-502
user: Missing Authorization vulnerability in Brizy Brizy Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy Pro: from n/a through 2.6.1.

assistant: CWE-862
user: Cross-Site Request Forgery (CSRF) vulnerability in RealMag777 InPost Gallery inpost-gallery allows Cross Site Request Forgery.This issue affects InPost Gallery: from n/a through <= 2.1.4.3.

assistant: CWE-352
user: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows Stored XSS.This issue affects Mortgage Calculator Estatik: from n/a through <= 2.0.12.

assistant: CWE-79
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows PHP Local File Inclusion.This issue affects Hide My WP Ghost: from n/a through <= 5.4.01.

assistant: CWE-706, CWE-829
user: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.

assistant: CWE-200
user: Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.2.6.

assistant: CWE-502
user: Cross-Site Request Forgery (CSRF) vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This issue affects Admin Menu Manager: from n/a through 1.0.3.

assistant: CWE-352
user: Cross-Site Request Forgery (CSRF) vulnerability in fs-code Booknetic booknetic.This issue affects Booknetic: from n/a through <= 4.0.9.

assistant: CWE-352
user: Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes AI Hub aihub allows Upload a Web Shell to a Web Server.This issue affects AI Hub: from n/a through <= 1.3.7.

assistant: CWE-434
user: Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Limit for WooCommerce: from n/a through <= 3.0.2.

assistant: CWE-862
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QuantumCloud ChatBot chatbot allows PHP Local File Inclusion.This issue affects ChatBot: from n/a through <= 6.3.5.

assistant: CWE-706, CWE-829
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through <= 2.6.7.

assistant: CWE-706, CWE-829
user: Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through <= 1.70.0.

assistant: CWE-94
user: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin allows SQL Injection.This issue affects Church Admin: from n/a through <= 5.0.18.

assistant: CWE-89
user: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in covertnine C9 Blocks c9-blocks allows DOM-Based XSS.This issue affects C9 Blocks: from n/a through <= 1.7.7.

assistant: CWE-79
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Deetronix Affiliate Coupons affiliate-coupons allows PHP Local File Inclusion.This issue affects Affiliate Coupons: from n/a through <= 1.7.3.

assistant: CWE-706, CWE-829
user: Missing Authorization vulnerability in Quý Lê 91 Administrator Z administrator-z allows Privilege Escalation.This issue affects Administrator Z: from n/a through <= 2025.03.24.

assistant: CWE-862
user: Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.9.

assistant: CWE-862
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.20.

assistant: CWE-706, CWE-829
user: Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through <= 1.2.16.

assistant: CWE-639
user: Authentication Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through <= 8.11.5.

assistant: CWE-306
user: Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.

assistant: CWE-502
user: Missing Authorization vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.

assistant: CWE-862
user: Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Ark Theme Core ark-core allows Code Injection.This issue affects Ark Theme Core: from n/a through < 1.71.0.

assistant: CWE-94
user: Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through <= 6.4.2.1.

assistant: CWE-639
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.9.0.

assistant: CWE-706, CWE-829
user: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Stored XSS.This issue affects Wired Impact Volunteer Management: from n/a through <= 2.5.

assistant: CWE-79
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support majestic-support allows PHP Local File Inclusion.This issue affects Majestic Support: from n/a through <= 1.0.6.

assistant: CWE-706, CWE-829
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Pearl - Corporate Business pearl allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a through < 3.4.8.

assistant: CWE-706, CWE-829
user: Improper Control of Generation of Code ('Code Injection') vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Code Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.0.1.

assistant: CWE-94
user: Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid  profilegrid-user-profiles-groups-and-communities allows Object Injection.This issue affects ProfileGrid : from n/a through <= 5.9.4.3.

assistant: CWE-502
user: Insertion of Sensitive Information Into Sent Data vulnerability in Shipmondo Shipmondo – A complete shipping solution for WooCommerce pakkelabels-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Shipmondo – A complete shipping solution for WooCommerce: from n/a through <= 5.0.3.

assistant: CWE-200
user: Missing Authorization vulnerability in NotFound Unlimited Timeline unlimited-timeline allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Unlimited Timeline: from n/a through < 1.6.1.

assistant: CWE-862
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows PHP Local File Inclusion.This issue affects Booking and Rental Manager: from n/a through <= 2.2.8.

assistant: CWE-706, CWE-829
user: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designingmedia Hostiko hostiko allows PHP Local File Inclusion.This issue affects Hostiko: from n/a through < 30.1.

assistant: CWE-706, CWE-829
user: Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows
 an attacker to utilize password-less user accounts and obtain 
system access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.

assistant: CWE-306
user: Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system

.


This issue affects MTC-9: from R22.1.1.0275 before R23.0.

assistant: CWE-306
user: Unrestricted access to OS file system in SFTP service in Infinera G42 
version R6.1.3 allows remote authenticated users to read/write OS files 
via SFTP connections.


Details: Account members of the Network Administrator profile can access the 
target machine via SFTP with the same credentials used for SSH CLI 
access and are able to read all files according to the OS permission instead of remaining inside the chrooted directory position.

assistant: CWE-755
user: The target device exposes a service on a specific TCP port with a configured
 endpoint. The access to that endpoint is granted using a Basic Authentication
 method. The endpoint accepts also the PUT method and it is possible to 
write files on the target device file system. Files are written as root.
 Using Postman it is possible to perform a Directory Traversal attack 
and write files into any location of the device file system. Similarly to the PUT method, it is possible to leverage the 
same mechanism to read any file from the file system by using the GET 
method.

assistant: CWE-755
user: Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.

assistant: CWE-119, CWE-125
user: information disclosure while invoking calibration data from user space to update firmware size.

assistant: CWE-119, CWE-125
user: memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.

assistant: CWE-416
user: Memory corruption while selecting the PLMN from SOR failed list.

assistant: CWE-129
user: Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.

assistant: CWE-416
user: Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

assistant: CWE-416
user: Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.

assistant: CWE-755
user: Transient DOS while processing video packets received from video firmware.

assistant: CWE-119, CWE-125
user: Memory corruption while processing video packets received from video firmware.

assistant: CWE-131
user: Memory corruption while processing manipulated payload in video firmware.

assistant: CWE-120
user: Memory corruption while executing timestamp video decode command with large input values.

assistant: CWE-787
user: Information disclosure while processing batch command execution in Video driver.

assistant: CWE-119, CWE-125
user: Memory corruption while processing multiple simultaneous escape calls.

assistant: CWE-415
user: Memory corruption while processing the TESTPATTERNCONFIG escape path.

assistant: CWE-416
user: Memory corruption while processing camera platform driver IOCTL calls.

assistant: CWE-119
user: Transient DOS while processing IOCTL call for image encoding.

assistant: CWE-119, CWE-125
user: Memory corruption while processing command message in WLAN Host.

assistant: CWE-415
user: Memory corruption while processing data packets in diag received from Unix clients.

assistant: CWE-120
user: Memory corruption during PlayReady APP usecase while processing TA commands.

assistant: CWE-131
user: Memory corruption while processing a malformed license file during reboot.

assistant: CWE-787
user: Memory corruption during sub-system restart while processing clean-up to free up resources.

assistant: CWE-416
user: Transient DOS while handling beacon frames with invalid IE header length.

assistant: CWE-119, CWE-125
user: Memory corruption while processing packet data with exceedingly large packet.

assistant: CWE-120
user: Memory corruption while performing SCM call with malformed inputs.

assistant: CWE-119
user: Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

assistant: CWE-787
user: Memory corruption during video playback when video session open fails with time out error.

assistant: CWE-416
user: Memory corruption while processing DDI call with invalid buffer.

assistant: CWE-129
user: Memory corruption while processing DDI command calls.

assistant: CWE-119
user: Memory corruption while performing encryption and decryption commands.

assistant: CWE-787
user: Memory corruption while processing specific files in Powerline Communication Firmware.

assistant: CWE-120
user: Information disclosure while processing a packet at EAVB BE side with invalid header length.

assistant: CWE-120
user: Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

assistant: CWE-129
user: Memory corruption while processing simultaneous requests via escape path.

assistant: CWE-367
user: Memory corruption while processing message in guest VM.

assistant: CWE-416
user: A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of Service.

assistant: CWE-400