rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-3501 Org.keycloak.protocol.services: keycloak hostname verification
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
Problem types: cwe_id: CWE-297
description: Improper Validation of Certificate with Host Mismatch
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:26
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 26
cpes: cpe:/a:redhat:build_keycloak:26
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0
cpes: cpe:/a:redhat:build_keycloak:26.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0
cpes: cpe:/a:redhat:build_keycloak:26.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0
cpes: cpe:/a:redhat:build_keycloak:26.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2025-04-29T20:45:29.507Z
CVE-2025-3502 WP Maps < 4.7.2 - Admin+ Stored XSS
The WP Maps  WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Maps
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2025-05-01T06:00:04.009Z
CVE-2025-3503 WP Maps < 4.7.2 - Admin+ Stored XSS
The WP Maps  WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Maps
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2025-05-01T06:00:04.224Z
CVE-2025-3504 WP Maps < 4.7.2 - Admin+ Stored XSS
The WP Maps  WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Maps
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2025-05-01T06:00:04.597Z
CVE-2025-3506 Potentially senitive path exposed via unauthenticated http route
Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and <Checkmk 2.4.0b6 allows attacker to access files that could contain secrets.
Problem types: cwe_id: CWE-497
description: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: Checkmk GmbH
product: Checkmk
default_status: unaffected
Credits: lang: en
value: Norman Kühnberger (IT Südwestfalen GmbH)
Published: 2025-05-08T11:24:24.682Z
CVE-2025-3508 Certain HP DesignJet products – Information disclosure
Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print job information.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: HP Inc.
product: Certain HP DesignJet products
default_status: unknown
Published: 2025-07-25T15:58:36.045Z
CVE-2025-3509 Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation
A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically allocated ports that become temporarily available, such as during a hot patch upgrade. This means the vulnerability is only exploitable during specific operational conditions, which limits the attack window. Exploitation required either site administrator permissions to enable and configure pre-receive hooks or a user with permissions to modify repositories containing pre-receive hooks where this functionality was already enabled. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18 and was fixed in versions 3.17.1, 3.16.4, 3.15.8, 3.14.13, 3.13.16. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: GitHub
product: Enterprise Server
default_status: affected
Credits: lang: en
value: R31n
Published: 2025-04-17T22:50:18.437Z
CVE-2025-3510 tagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tagDiv
product: tagDiv Composer
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Matthew Rollings
Published: 2025-05-02T03:21:18.095Z
CVE-2025-3512 Buffer overflow in QTextMarkdownImporter
There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow.This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: The Qt Company
product: Qt
default_status: unaffected
Credits: lang: en
value: oss-fuzz
Published: 2025-04-11T07:39:48.298Z
CVE-2025-3513 SureForms < 1.4.4 - Admin+ Stored XSS
The SureForms  WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: SureForms
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2025-05-02T06:00:02.187Z
CVE-2025-3514 SureForms < 1.4.4 - Admin+ Stored XSS
The SureForms  WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: SureForms
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2025-05-02T06:00:02.905Z
CVE-2025-3515 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: glenwpcoder
product: Drag and Drop Multiple File Upload for Contact Form 7
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Michael Mazzolini
Published: 2025-06-17T09:21:39.083Z
CVE-2025-3516 Simple Lightbox < 2.9.4 - Contributor+ Stored XSS
The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Lightbox
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: WPScan
Published: 2025-05-16T06:00:04.784Z
CVE-2025-3517 
Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username.
Problem types: cwe_id: CWE-266
description: CWE-266: Incorrect Privilege Assignment
Affected products: vendor: Devolutions
product: Devolutions Server
default_status: unaffected
Published: 2025-05-01T18:26:22.565Z
CVE-2025-3518 File upload functionality possible even when disabled
It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.

The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.

If file sharing is generally enabled, this issue is not of concern.
Affected products: vendor: Unblu inc.
product: Unblu Spark
default_status: unknown
Credits: lang: en
value: Andrei Dabrakou of Citadelo  (andrei.dabrakou@citadelo.com)
Published: 2025-04-22T08:49:56.073Z
CVE-2025-3519 Replace uploaded files knowing the file upload ID
An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file.

Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unblu inc.
product: Unblu Spark
default_status: unknown
Credits: lang: en
value: Andrei Dabrakou of Citadelo  (andrei.dabrakou@citadelo.com)
Published: 2025-04-22T08:51:41.681Z
CVE-2025-3520 Avatar <= 0.1.4 - Authenticated (Subscriber+) Arbitrary File Deletion
The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 0.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: wonderboymusic
product: Avatar
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Youcef Hamdani
Published: 2025-04-18T01:44:09.879Z
CVE-2025-3521 Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: wpspeedo
product: Team Members Showcase
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Siavash Vaez Afshar
Published: 2025-05-01T06:40:16.242Z
CVE-2025-3522 Leak of hashed Window credentials via crafted attachment URL
Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to  determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.
Affected products: vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Dario Weißer
Published: 2025-04-15T15:06:13.599Z
CVE-2025-3523 User Interface (UI) Misrepresentation of attachment URL
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.
Affected products: vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Dario Weißer
Published: 2025-04-15T15:06:14.164Z
CVE-2025-3525 Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have, under certain circumstances, allowed an authenticated user with certain access to cause Denial of Service by creating specially crafted CI triggers via the API.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [pwnie](https://hackerone.com/pwnie) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2026-02-25T19:33:56.609Z
CVE-2025-3526 
SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP requests.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Liferay
product: Portal
default_status: unaffected
vendor: Liferay
product: DXP
default_status: unaffected
Published: 2025-06-16T14:18:34.913Z
CVE-2025-3527 EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib/settings/settings.js' file in all versions up to, and including, 4.9.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.9.6.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: EventON
product: EventON (Pro) - WordPress Virtual Event Calendar Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: anhchangmutrang
Published: 2025-05-17T11:17:16.160Z
CVE-2025-3528 Mirror-registry: local privilege escalation due to incorrect permissions in mirror-registry
A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within that pod.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: default_status: unaffected
vendor: Red Hat
product: MIRROR-REGISTRY-2.0-RHEL-8
cpes: cpe:/a:redhat:mirror_registry:2.0.0::el8
default_status: affected
vendor: Red Hat
product: mirror registry for Red Hat OpenShift
cpes: cpe:/a:redhat:mirror_registry:1
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Antony Di Scala and Mike Whale for reporting this issue.
Published: 2025-05-09T11:58:24.957Z
CVE-2025-3529 WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: mra13
product: Simple Shopping Cart
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
baseScore: 8.2
baseSeverity: HIGH
Credits: lang: en
value: Jack Taylor
Published: 2025-04-23T07:06:49.072Z
CVE-2025-3530 WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.
Problem types: cwe_id: CWE-472
description: CWE-472 External Control of Assumed-Immutable Web Parameter
Affected products: vendor: mra13
product: Simple Shopping Cart
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Jack Taylor
Published: 2025-04-23T07:06:49.749Z
CVE-2025-3531 YouDianCMS index.html cross site scripting
A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: n/a
product: YouDianCMS
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: zonesec (VulDB User)
Published: 2025-04-13T05:31:04.976Z
CVE-2025-3532 YouDianCMS index.html.Attackers cross site scripting
A vulnerability classified as problematic was found in YouDianCMS 9.5.21. This vulnerability affects unknown code of the file /App/Tpl/Member/Default/Order/index.html.Attackers. The manipulation of the argument OrderNumber leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: n/a
product: YouDianCMS
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: zonesec (VulDB User)
Published: 2025-04-13T06:00:10.234Z