rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-15572 wasm3 NewCodePage memory leak
A vulnerability has been found in wasm3 up to 0.5.0. The affected element is the function NewCodePage. The manipulation leads to memory leak. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Unfortunately, the project has no active maintainer at the moment.
Problem types: cwe_id: CWE-401
description: Memory Leak
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: wasm3
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Oneafter (VulDB User)
Published: 2026-02-10T15:32:08.031Z
CVE-2025-15573 Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection
The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: SolaX Power
product: Pocket WiFi 3.0
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi+LAN
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi+4GM
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi+LAN 2.0
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi 4.0
default_status: unaffected
Credits: lang: en
value: Stefan Viehböck, SEC Consult Vulnerability Lab
Published: 2026-02-12T10:39:35.796Z
CVE-2025-15574 Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud Connection
When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the "registration number" using a proprietary XOR/transposition algorithm. Attackers with the knowledge of the registration numbers can connect to the MQTT server and impersonate the dongle / inverters.
Problem types: cwe_id: CWE-330
description: CWE-330 Use of Insufficiently Random Values
Affected products: vendor: SolaX Power
product: Pocket WiFi 3.0
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi+LAN
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi+4GM
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi+LAN 2.0
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi 4.0
default_status: unaffected
Credits: lang: en
value: Stefan Viehböck, SEC Consult Vulnerability Lab
Published: 2026-02-12T10:58:29.373Z
CVE-2025-15575 Missing Firmware Authenticity Checks in Solax Power Pocket WiFi models
The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not show any cryptographic checks (e.g. digital signature checks) on the supplied firmware update files. Furthermore, ESP32 security features such as secure boot are not used.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: SolaX Power
product: Pocket WiFi 3.0
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi+LAN
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi+4GM
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi+LAN 2.0
default_status: unaffected
vendor: SolaX Power
product: Pocket WiFi 4.0
default_status: unaffected
Credits: lang: en
value: Stefan Viehböck, SEC Consult Vulnerability Lab
Published: 2026-02-12T10:51:44.650Z
CVE-2025-15576 Jail chroot escape via fd exchange with a different jail
If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the administrator has configured one.

In this case, cooperating processes in the two jails may establish a connection using a unix domain socket and exchange directory descriptors with each other.

When performing a filesystem name lookup, at each step of the lookup, the kernel checks whether the lookup would descend below the jail root of the current process.  If the jail root directory is not encountered, the lookup continues.

In a configuration where processes in two different jails are able to exchange file descriptors using a unix domain socket, it is possible for a jailed process to receive a directory for a descriptor that is below that process' jail root.  This enables full filesystem access for a jailed process, breaking the chroot.

Note that the system administrator is still responsible for ensuring that an unprivileged user on the jail host is not able to pass directory descriptors to a jailed process, even in a patched kernel.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
cwe_id: CWE-488
description: CWE-488: Exposure of Data Element to Wrong Session
cwe_id: CWE-790
description: CWE-790: Improper Filtering of Special Elements
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Published: 2026-03-09T11:54:20.630Z
CVE-2025-15577 Valmet DNA Web server arbitrary file read access
An unauthenticated attacker can exploit this vulnerability by manipulating URL to achieve arbitrary file read access.This issue affects Valmet DNA Web Tools: C2022 and older.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Valmet
product: Valmet DNA Web Tools
default_status: unaffected
Credits: lang: en
value: Denis Samotuga
Published: 2026-02-12T06:04:56.536Z
CVE-2025-15578 Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely
Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.
Problem types: cwe_id: CWE-338
description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Affected products: vendor: TEEJAY
product: Maypole
default_status: unaffected
Credits: lang: en
value: Robert Rothenberg
Published: 2026-02-16T21:18:16.085Z
CVE-2025-15579 An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services.
Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. 

The vulnerability could lead to remote code execution, denial of service, or privilege escalation.

This issue affects Directory Services: before 24.4.16, from 25.1 before 25.1.9, from 25.2 before 25.2.9, from 25.3 before 25.3.8, from 25.4 before 25.4.5, from 26.1 before 26.1.2.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: OpenText™
product: Directory Services
default_status: unaffected
Credits: lang: en
value: Dylan Pindur - Assetnote
lang: en
value: Adam Kues - Assetnote
lang: en
value: Tomais Williamson - Assetnote
Published: 2026-02-18T14:57:04.010Z
CVE-2025-15581 
Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. 

Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: orthanc-server
product: orthanc
default_status: unaffected
Published: 2026-02-18T22:59:55.491Z
CVE-2025-15582 detronetdip E-commerce Product Management Update authorization
A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-639
description: Authorization Bypass
cwe_id: CWE-285
description: Improper Authorization
Affected products: vendor: detronetdip
product: E-commerce
cpes: cpe:2.3:a:detronetdip:e-commerce:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Nixon-H (VulDB User)
Published: 2026-02-20T16:32:07.871Z
CVE-2025-15583 detronetdip E-commerce function.php get_safe_value cross site scripting
A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: detronetdip
product: E-commerce
cpes: cpe:2.3:a:detronetdip:e-commerce:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Nixon-H (VulDB User)
Published: 2026-02-20T16:32:10.015Z
CVE-2025-15584 Endpoint DLP Driver Filter Communication Port Integer Overflow
Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an integer overflow within the filter communication port, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer overflow or wraparound
Affected products: vendor: Netskope
product: Endpoint DLP Module for Netskope Client
default_status: unaffected
Credits: lang: en
value: Tom Brice
Published: 2026-03-17T18:55:59.156Z
CVE-2025-15585 
Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successful exploitation requires the system to use MySQL as the underlying database and could result in privilege escalation or data exfiltration.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: fileflows
product: fileflows
default_status: unaffected
Published: 2026-02-18T23:44:40.034Z
CVE-2025-15586 
OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentication bypass without knowledge of the victim account's password.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: OpenGamePanel
product: OGP-Website
default_status: unaffected
Published: 2026-02-19T03:41:04.720Z
CVE-2025-15587 Credentials exposure in tinycontrol devices
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface.

This issue has been fixed in firmware versions: 1.36 (for tcPDU), 1.67 (for LK3.5 - hardware versions: 3.5, 3.6, 3.7 and 3.8), 1.75 (for LK3.9 - hardware version 3.9) and 1.38 (for LK4 - hardware version 4.0).
Problem types: cwe_id: CWE-425
description: CWE-425 Direct Request ('Forced Browsing')
Affected products: vendor: tinycontrol
product: Lan Kontroler v3.5
default_status: unaffected
vendor: tinycontrol
product: LK3.9
default_status: unaffected
vendor: tinycontrol
product: LK4
default_status: unaffected
vendor: tinycontrol
product: tcPDU
default_status: unaffected
Published: 2026-03-16T09:26:00.418Z
CVE-2025-15589 MuYuCMS Template Management Template.php delete_dir_file path traversal
A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: n/a
product: MuYuCMS
cpes: cpe:2.3:a:muyucms:muyucms:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: b1uel0n3 (VulDB User)
Published: 2026-02-24T05:52:29.889Z
CVE-2025-15595 Privilege escalation via dll hijacking in Inno Setup
Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.
Problem types: cwe_id: CWE-1390
description: CWE-1390: Weak Authentication
Affected products: vendor: mlsoft
product: Inno Setup
default_status: unaffected
Published: 2026-03-03T06:13:07.636Z
CVE-2025-15597 Dataease SQLBot API Endpoint assistant.py access control
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: Dataease
product: SQLBot
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: yaowenxiao (VulDB User)
lang: en
value: VulDB
Published: 2026-03-02T06:16:35.439Z
CVE-2025-15598 Dataease SQLBot JWT Token auth.py validateEmbedded signature verification
A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the component JWT Token Handler. Performing a manipulation results in improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been made public and could be used. A comment in the source code warns users about using this feature. The vendor was contacted early about this disclosure.
Problem types: cwe_id: CWE-347
description: Improper Verification of Cryptographic Signature
cwe_id: CWE-345
description: Insufficient Verification of Data Authenticity
Affected products: vendor: Dataease
product: SQLBot
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
baseSeverity: LOW
Credits: lang: en
value: yaowenxiao (VulDB User)
lang: en
value: VulDB
Published: 2026-03-03T09:32:06.880Z
CVE-2025-15599 DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML
DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: cure53
product: DOMPurify
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Scott Moore - VulnCheck
Published: 2026-03-03T17:26:05.711Z
CVE-2025-15602 Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.
Problem types: cwe_id: CWE-915
description: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products: vendor: Grokability, Inc.
product: Snipe-IT
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noah Heraud
lang: en
value: Luca D.
Published: 2026-03-06T16:16:08.531Z
CVE-2025-15603 open-webui JWT Key start_windows.bat random values
A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/start_windows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUI_SECRET_KEY leads to insufficiently random values. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-330
description: Insufficiently Random Values
cwe_id: CWE-310
description: Cryptographic Issues
Affected products: vendor: n/a
product: open-webui
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
baseSeverity: LOW
Credits: lang: en
value: I4m6da (VulDB User)
Published: 2026-03-09T20:32:06.017Z
CVE-2025-15604 Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions
Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions.

In versions 6.06 through 6.16, the random_string function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes by concatenating a SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time.  The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.

Before version 6.06, there was no fallback when /dev/urandom was not available.

Before version 6.04, the random_string function used the built-in rand() function to generate a mixed-case alphanumeric string.

This function may be used for generating session ids, generating secrets for signing or encrypting cookie session data and generating tokens used for Cross Site Request Forgery (CSRF) protection.
Problem types: cwe_id: CWE-340
description: CWE-340 Generation of Predictable Numbers or Identifiers
cwe_id: CWE-338
description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Affected products: vendor: TOKUHIROM
product: Amon2
default_status: unaffected
Published: 2026-03-28T18:43:56.318Z
CVE-2025-15605 Hardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600
A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, modify them, and re-encrypt them, affecting the confidentiality and integrity of device configuration data.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: TP-Link Systems Inc.
product: Archer NX600 v3.0
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer NX600 v2.0
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer NX600 v1.0
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer NX500 v2.0
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer NX500 v1.0
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer NX210 v3.0
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer NX210 v2.0 v2.20
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer NX200 v3.0
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer NX200 v2.20
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer NX200 v2.0
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer NX200 v1.0
default_status: unaffected
Credits: lang: en
value: Saifeldeen Aziz from Cyshield
Published: 2026-03-23T18:02:01.109Z
CVE-2025-15606 Denial of Service (DoS) in HTTPD Input Handling on TP-Link TD-W8961N
A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigger a processing error that causes the httpd service to crash.  Successful exploitation may allow the attacker to cause service interruption, resulting in a DoS condition.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper input validation
Affected products: vendor: TP-Link Systems Inc.
product: TD-W8961N v4.0
default_status: unaffected
Credits: lang: en
value: RONBUB
Published: 2026-03-23T18:36:15.648Z
CVE-2025-15607 Authenticated Command Injection in mcsd Service of TP-Link Archer AX53
A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation of unvalidated file content into shell commands, enabling authenticated attackers to inject and execute arbitrary commands.  Successful exploitation may allow execution of malicious commands and ultimately full control of the device.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: TP-Link Systems Inc.
product: AX53 v1
default_status: unaffected
Credits: lang: en
value: samuzora
Published: 2026-03-20T16:31:12.808Z