rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-40646 Multiple vulnerabilities in Energy CRM by Status Tracker
Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Status Tracker
product: Energy CRM
default_status: unaffected
Credits: lang: en
value: Andrea Intilangelo
Published: 2025-10-02T09:42:30.375Z
CVE-2025-40647 Stored Cross-Site Scripting (XSS) vulnerability in Issabel products
Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'email' parameter in '/index.php?menu=address_book'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: issabel-pbx module
product: Issabel
default_status: unaffected
vendor: Issabel, issabel-agenda module
product: Issabel
default_status: unaffected
Credits: lang: en
value: Oriol Vilella Jam
Published: 2025-10-01T12:30:02.773Z
CVE-2025-40648 Stored Cross-Site Scripting (XSS) vulnerability in Issabel products
Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'numero_conferencia' parameter in '/index.php?menu=conferencia'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: issabel-pbx module
product: Issabel
default_status: unaffected
vendor: Issabel, issabel-agenda module
product: Issabel
default_status: unaffected
Credits: lang: en
value: Oriol Vilella Jam
Published: 2025-10-01T12:30:44.653Z
CVE-2025-40649 Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC
Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure (BBMRI-ERIC), consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using parameter text in '/api/v3/negotiations/<postUID>/posts'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: BBMRI-ERIC
product: Negotiator
default_status: unaffected
Credits: lang: en
value: Erlaitz Parreño Muñoz
Published: 2025-10-07T12:20:56.828Z
CVE-2025-40650 Insecure Direct Object Reference (IDOR) in Clickedu
Insecure Direct Object Reference (IDOR) vulnerability in Clickedu. This vulnerability could allow an attacker to retrieve information about student report cards.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Clickedu
product: Clickedu
default_status: unaffected
Credits: lang: en
value: Kevin Gonzalvo Vicente
Published: 2025-05-26T12:51:32.391Z
CVE-2025-40651 Reflected Cross Site Scripting (XSS) in Real Easy Store
Reflected Cross-Site Scripting (XSS) vulnerability in Real Easy Store. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the keyword parameter in /index.php?a=search. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Real Easy Store
product: Real Easy Store
default_status: unaffected
Credits: lang: en
value: Edgar Carrillo
Published: 2025-05-28T13:24:22.092Z
CVE-2025-40652 Cross-Site Scripting (XSS) in CoverManager
Stored Cross-Site Scripting (XSS) vulnerability in the CoverManager booking software. This allows an attacker to inject malicious scripts into the application, which are permanently stored on the server. The malicious scripts are executed in the browser of any user visiting the affected page without the user having to take any further action. This can allow the attacker to steal sensitive information, such as session cookies, login credentials, and perform actions on behalf of the affected user.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: CoverManager
product: CoverManager
default_status: unaffected
Credits: lang: en
value: Javier Paradelo Rodriguez
Published: 2025-05-26T12:52:43.162Z
CVE-2025-40653 User enumeration in M3M Printer Server Web
User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force attack on valid usernames.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: M3M
product: M3M Printer Server Web
default_status: unaffected
Credits: lang: en
value: David Padilla Alvarado
Published: 2025-05-26T12:54:08.905Z
CVE-2025-40654 SQL injection vulnerability in DM Corporative CMS
A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the name and cod parameters in /antbuspre.asp.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Dmacroweb
product: DM Corporative CMS
default_status: unaffected
Credits: lang: en
value: Oscar Atienza
Published: 2025-06-10T10:01:14.010Z
CVE-2025-40655 SQL injection vulnerability in DM Corporative CMS
A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the name parameter in /antcatalogue.asp.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Dmacroweb
product: DM Corporative CMS
default_status: unaffected
Credits: lang: en
value: Oscar Atienza
Published: 2025-06-10T10:03:24.120Z
CVE-2025-40656 SQL injection vulnerability in DM Corporative CMS
A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the cod parameter in /administer/node-selection/data.asp.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Dmacroweb
product: DM Corporative CMS
default_status: unaffected
Credits: lang: en
value: Oscar Atienza
Published: 2025-06-10T10:03:49.029Z
CVE-2025-40657 SQL injection vulnerability in DM Corporative CMS
A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the codform parameter in /modules/forms/collectform.asp.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Dmacroweb
product: DM Corporative CMS
default_status: unaffected
Credits: lang: en
value: Oscar Atienza
Published: 2025-06-10T10:04:09.279Z
CVE-2025-40658 Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS
An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/framesSelection.asp.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Dmacroweb
product: DM Corporative CMS
default_status: unaffected
Credits: lang: en
value: Oscar Atienza
Published: 2025-06-10T10:05:46.265Z
CVE-2025-40659 Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS
An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/framesSelectionNetworks.asp.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Dmacroweb
product: DM Corporative CMS
default_status: unaffected
Credits: lang: en
value: Oscar Atienza
Published: 2025-06-10T10:06:09.181Z
CVE-2025-40660 Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS
An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/select node/data.asp?mode=catalogue&id1=1&id2=1session=&cod=1&networks=0.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Dmacroweb
product: DM Corporative CMS
default_status: unaffected
Credits: lang: en
value: Oscar Atienza
Published: 2025-06-10T10:06:27.167Z
CVE-2025-40661 Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS
An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/selection.asp.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Dmacroweb
product: DM Corporative CMS
default_status: unaffected
Credits: lang: en
value: Oscar Atienza
Published: 2025-06-10T10:06:40.672Z
CVE-2025-40662 Absolute path disclosure vulnerability in DM Corporative CMS
Absolute path disclosure vulnerability in DM Corporative CMS. This vulnerability allows an attacker to view the contents of webroot/file, if navigating to a non-existent file.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Dmacroweb
product: DM Corporative CMS
default_status: unaffected
Credits: lang: en
value: Oscar Atienza
Published: 2025-06-10T10:07:32.257Z
CVE-2025-40663 Stored Cross-Site Scripting (XSS) in i2A-Cronos by i2A
Stored Cross-Site Scripting (XSS) vulnerability in i2A-Cronos version 23.02.01.17, from i2A. It allows an authenticated attacker to upload a malicious SVG image into the user's personal space in /CronosWeb/Modules/Persons/PersonalDocuments/PersonalDocuments.
There is no reported fix at this time.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: i2A
product: Cronos
default_status: unaffected
Credits: lang: en
value: David Padilla Alvarado
Published: 2025-05-26T12:55:30.974Z
CVE-2025-40664 Missing authentication vulnerability in TCMAN GIM v11
Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Carlos Aguadé
Published: 2025-05-26T12:47:09.138Z
CVE-2025-40665 Time-based blind SQL injection vulnerability in TCMAN GIM v11
Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in /GIMWeb/PC/frmCorrectivosList.aspx.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Carlos Aguadé
Published: 2025-05-26T12:48:08.755Z
CVE-2025-40666 Time-based blind SQL injection vulnerability in TCMAN GIM v11
Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in/GIMWeb/PC/frmPreventivosList.aspx.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Carlos Aguadé
Published: 2025-05-26T12:48:21.940Z
CVE-2025-40667 Missing authorization vulnerability in TCMAN GIM v11
Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are not available through the user interface. To exploit the vulnerability the attacker must modify the HTTP code of the response from ‘302 Found’ to ‘200 OK’, as well as the hidden fields hdnReadOnly and hdnUserLogin.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Carlos Aguadé
Published: 2025-05-26T12:49:49.315Z
CVE-2025-40668 Incorrect Authorization vulnerability in TCMAN GIM
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Jorge Riopedre Vega
Published: 2025-06-09T12:25:59.654Z
CVE-2025-40669 Incorrect Authorization vulnerability in TCMAN GIM
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&amp;Page=-1.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Jorge Riopedre Vega
Published: 2025-06-09T12:26:11.761Z
CVE-2025-40670 Incorrect Authorization vulnerability in TCMAN GIM
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: TCMAN
product: GIM
default_status: unaffected
Credits: lang: en
value: Jorge Riopedre Vega
Published: 2025-06-09T12:26:28.525Z
CVE-2025-40671 SQL injection vulnerability in AES Multimedia's Gestnet
SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘fk_remoto_central’ parameter on the ‘/webservices/articles.php’ endpoint.
Problem types: cwe_id: CWE-93
description: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected products: vendor: AES Multimedia
product: Gestnet
default_status: unaffected
Credits: lang: en
value: Guzmán Fernández
Published: 2025-05-26T09:08:05.238Z
CVE-2025-40672 Privilege Escalation in Panloader.exe
A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the file panLoad.exe that will be executed by SYSTEM user via a programmed task. This would allow an attacker to obtain administrator permissions to perform whatever activities he/she wants, shuch as accessing sensitive information, executing code remotely, and even causing a denial of service (DoS).
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Grupo Espiral MS
product: Panloader.exe
default_status: unaffected
Credits: lang: en
value: Pablo Arriaga Perez
Published: 2025-05-26T09:05:40.862Z
CVE-2025-40673 Missing Authorization in DinoRANK
A Missing Authorization vulnerability has been found in DinoRANK. This 
vulnerability allows an attacker to access invoices of any user via 
accessing endpoint '/facturas/YYYY-MM/SDRYYMM-XXXXX.pdf' because there 
is no access control. The pdf filename can be obtained via OSINT, 
insecure network traffic or brute force.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: DinoRANK
product: DinoRANK
default_status: affected
Credits: lang: en
value: Pablo Alcarria
Published: 2025-05-28T10:54:46.595Z
CVE-2025-40674 Reflected Cross-Site Scripting (XSS) in osCommerce
Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: osCommerce
product: osCommerce
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-06-17T08:50:17.363Z
CVE-2025-40675 Reflected Cross-Site Scripting (XSS) in Bagisto
A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Bagisto
product: Bagisto
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-06-09T09:42:18.409Z
CVE-2025-40676 Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC
Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This vulnerability allows an attacker to access or modify unauthorised resources by manipulating requests that use the 'userID' parameter in '/api/v3/users/<userID>', which may result in the exposure or alteration of sensitive data
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: BBMRI-ERIC
product: Negotiator
default_status: unaffected
Credits: lang: en
value: Erlaitz Parreño Muñoz
Published: 2025-10-07T12:21:37.629Z
CVE-2025-40677 SQL injection vulnerability in Summar Software´s Portal del Empleado
SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Summar Software
product: Portal del Empleado
default_status: unaffected
Credits: lang: en
value: Pedro Gabaldón Juliá
lang: en
value: Javier Medina Munuera
lang: en
value: Antonio José Gálvez Sánchez
lang: en
value: Alejandro Baño Andrés
lang: en
value: Álvaro Piñero Laorden
Published: 2025-09-18T11:46:31.676Z
CVE-2025-40678 Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado
Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerous file type by sending a POST request using the parameter “cctl00$ContentPlaceHolder1$fuAdjunto” in “/MemberPages/ntf_absentismo.aspx”.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Summar Software
product: Portal del Empleado
default_status: unaffected
Credits: lang: en
value: Pedro Gabaldón Juliá
lang: en
value: Javier Medina Munuera
lang: en
value: Antonio José Gálvez Sánchez
lang: en
value: Alejandro Baño Andrés
lang: en
value: Álvaro Piñero Laorden
Published: 2025-09-18T11:47:29.812Z
CVE-2025-40679 HTML injection in Isshue from Bdtask
HTML 

Injection vulnerability in  Isshue by Bdtask, consisting os an HTML injection due to a lack os proper validation of user input by sending a POST request to '/category_product_search', affecting the 'product_name' parameter.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Bdtask
product: Isshue
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-01-20T11:53:39.846Z
CVE-2025-40680 Encryption of sensitive data in CapillaryScope missing
Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text within different registry keys on the Windows operating system. Any authenticated local user with read access to the registry can extract these sensitive values.
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: Capillary io
product: CapillaryScope
default_status: unaffected
Credits: lang: en
value: Ismael Melchor Juan
lang: en
value: Pedro José Navas Pérez
Published: 2025-07-24T12:14:20.971Z
CVE-2025-40681 Cross-Site Scripting (XSS) in xCally Omnichannel
Cross-site Scripting (XSS) vulnerability reflected in xCally's Omnichannel v3.30.1. This vulnerability allowsan attacker to executed JavaScript code in the victim's browser by sending them a malicious URL using the 'failureMessage' parameter in '/login'. This vulnerability can be exploited to steal sentitive user data, such as session cookies , or to perform actions on behalf of the user.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: xCally
product: Omnichannel
default_status: unaffected
Credits: lang: en
value: Adrià Alavedra Palacios
Published: 2025-11-13T12:57:00.745Z