rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-45081 
Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-01T00:00:00.000Z
CVE-2025-45083 
Incorrect access control in Ullu (Android version v2.9.929 and IOS version v2.8.0) allows attackers to bypass parental pin feature via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-01T00:00:00.000Z
CVE-2025-45091 
Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notification and activities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-15T00:00:00.000Z
CVE-2025-45095 
Lavasoft Web Companion (also known as Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 installs the DCIService.exe service with an unquoted service path vulnerability. An attacker with write access to the file system could potentially execute arbitrary code with elevated privileges by placing a malicious executable in the unquoted path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-09T00:00:00.000Z
CVE-2025-45143 
string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-30T00:00:00.000Z
CVE-2025-45145 
Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 allows remote attackers to read arbitrary system and application files via the image parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-22T00:00:00.000Z
CVE-2025-45146 
ModelCache for LLM through v0.2.0 was discovered to contain an deserialization vulnerability via the component /manager/data_manager.py. This vulnerability allows attackers to execute arbitrary code via supplying crafted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-11T00:00:00.000Z
CVE-2025-45150 
Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-01T00:00:00.000Z
CVE-2025-45156 
Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-45157 
Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-45160 
A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application reflects the submitted filename back into an error popup without proper sanitization. As a result, attackers can inject arbitrary HTML elements (e.g., <h1>, <b>, <svg>) into the rendered page. NOTE: Multiple third-parties including the maintainer have stated that they cannot reproduce this issue after 1.2.27.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-29T00:00:00.000Z
CVE-2025-45236 
A stored cross-site scripting (XSS) vulnerability in the Edit Profile feature of DBSyncer v2.0.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Nickname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-45237 
Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information, including the encrypted password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-45238 
foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-45239 
An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-45240 
foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-45242 
Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-45250 
MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-06T00:00:00.000Z
CVE-2025-45286 
A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-02T00:00:00.000Z
CVE-2025-45311 
Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to perform arbitrary operations as root. NOTE: this is disputed by multiple parties because the action for a triggered rule can legitimately be an arbitrary operation as root. Thus, the software is behaving in accordance with its intended privilege model.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-26T00:00:00.000Z
CVE-2025-45313 
A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-13T00:00:00.000Z
CVE-2025-45314 
A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-13T00:00:00.000Z
CVE-2025-45315 
A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-13T00:00:00.000Z
CVE-2025-45316 
A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-13T00:00:00.000Z
CVE-2025-45317 
A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-13T00:00:00.000Z
CVE-2025-45320 
A Directory Listing Vulnerability was found in the /osms/Requester/ directory of the Kashipara Online Service Management Portal V1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-45321 
kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in /osms/Requester/Requesterchangepass.php via the parameter: rPassword.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-45322 
kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in osms/Requester/CheckStatus.php via the checkid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-45326 
An issue in PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1 allows remote attackers to execute arbitrary code via the submit_size.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-23T00:00:00.000Z
CVE-2025-45331 
brplot v420.69.1 contains a Null Pointer Dereference (NPD) vulnerability in the br_dagens_handle_once function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-20T00:00:00.000Z
CVE-2025-45332 
vkoskiv c-ray 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the parse_mtllib function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-25T00:00:00.000Z
CVE-2025-45333 
berkeley-abc abc 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the Abc_NtkCecFraigPart function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-25T00:00:00.000Z
CVE-2025-45343 
An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of the account module in the goform/setmodules route.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-28T00:00:00.000Z
CVE-2025-45346 
SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2025-45375 
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-10-07T19:00:28.539Z
CVE-2025-45376 
Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Problem types: cwe_id: CWE-280
description: CWE-280: Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: Dell
product: Dell Repository Manager (DRM)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Dell would like to thank Ouallaout Noureddine for reporting this issue
Published: 2025-09-29T20:13:36.928Z
CVE-2025-45378 
Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of CloudLink server and gain access of shell and escalate privilege, gain unauthorized access of system.

If ssh is enabled with web credentials of server, attack is possible through network with known privileged user/password.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Dell
product: CloudLink
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-11-05T16:23:15.673Z
CVE-2025-45379 
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell access of system.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Dell
product: CloudLink
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-11-05T16:31:57.457Z
CVE-2025-45387 
osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-02T00:00:00.000Z
CVE-2025-45388 
Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been well documented that when serving uploaded files using a method outside of Wagtail (which admittedly is the default), it requires additional configuration from the developer, because Wagtail cannot control how these are served. ... For example, if a Wagtail instance is configured to upload files into AWS S3, Wagtail cannot control the permissions on how they're served, nor any headers used when serving them (a limitation of S3)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-07T00:00:00.000Z
CVE-2025-45406 
A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbar_time, and because debugbar-related data is automatically escaped by the CodeIgniter Parser class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-25T00:00:00.000Z
CVE-2025-45424 
Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-02T00:00:00.000Z
CVE-2025-45427 
In Tenda AC9 v1.0 with firmware V15.03.05.14_multi, the security parameter of /goform/WifiBasicSet has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-23T00:00:00.000Z
CVE-2025-45428 
In Tenda ac9 v1.0 with firmware V15.03.05.14_multi, the rebootTime parameter of /goform/SetSysAutoRebbotCfg has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-23T00:00:00.000Z
CVE-2025-45429 
In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow vulnerability in /goform/WifiWpsStart, which may lead to remote arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-23T00:00:00.000Z
CVE-2025-45466 
Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-25T00:00:00.000Z
CVE-2025-45467 
Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-25T00:00:00.000Z
CVE-2025-45468 
Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2025-45471 
Insecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2025-45472 
Insecure permissions in autodeploy-layer v1.2.0 allows attackers to escalate privileges and compromise the customer cloud account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2025-45474 
maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-29T00:00:00.000Z