rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-34112 Riverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCE
An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. A SQL injection vulnerability in the '/api/common/1.0/login' endpoint can be exploited to create a new user account in the appliance database. This user can then trigger a command injection vulnerability in the '/index.php?page=licenses' endpoint to execute arbitrary commands. The attacker may escalate privileges to root by exploiting an insecure sudoers configuration that allows the 'mazu' user to execute arbitrary commands as root via SSH key extraction and command chaining. Successful exploitation allows full remote root access to the virtual appliance.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: Riverbed Technology
product: SteelCentral NetExpress
default_status: unaffected
vendor: Riverbed Technology
product: SteelCentral NetProfiler
default_status: unknown
Credits: lang: en
value: Francesco Oddo of Security-Assessment.com
Published: 2025-07-15T13:07:31.186Z
CVE-2025-34113 Tiki Wiki CMS Authenticated Command Injection in Calendar Module
An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` GET parameter in `tiki-calendar.php`. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execute arbitrary PHP code. Successful exploitation leads to remote code execution in the context of the web server user.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Tiki Software Community Association
product: Wiki CMS Groupware
default_status: unaffected
Credits: lang: en
value: Dany Ouellet
Published: 2025-07-15T13:09:34.329Z
CVE-2025-34114 OpenBlow Missing Critical Security Headers
A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the absence of critical HTTP response headers including Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy. This omission weakens browser-level defenses and exposes users to cross-site scripting (XSS), clickjacking, and referer leakage. Although some instances attempt to enforce CSP via HTML <meta> tags, this method is ineffective, as modern browsers rely on header-based enforcement to reliably block inline scripts and untrusted resources.
Problem types: cwe_id: CWE-749
description: CWE-749 Exposed Dangerous Method or Function
cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Laser Romae s.r.l.
product: OpenBlow
default_status: unaffected
Credits: lang: en
value: Tifa Lockhart
Published: 2025-07-25T15:52:56.387Z
CVE-2025-34115 OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php
An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: ITRS Group
product: OP5 Monitor
default_status: unaffected
Credits: lang: en
value: hyp3rlinx
Published: 2025-07-15T13:04:01.581Z
CVE-2025-34116 IPFire < 2.19 Core Update 101 proxy.cgi RCE
A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: IPFire Project
product: IPFire
default_status: unaffected
Credits: lang: en
value: Yann Cam
Published: 2025-07-15T13:02:31.571Z
CVE-2025-34117 Netcore / Netis Routers RCE via UDP Port 53413 Backdoor
A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.
Problem types: cwe_id: CWE-912
description: CWE-912 Hidden Functionality
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Netcore Technology
product: Router firmware
default_status: affected
vendor: Netis
product: Router firmware
default_status: affected
Credits: lang: en
value: Trend Micro TrendLabs
Published: 2025-07-16T21:02:57.281Z
CVE-2025-34118 Linknat VOS Manager Path Traversal File Disclosure
A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/', '/chs/', or '/cht/', where the 'js/lang_en_us.js' or equivalent files are loaded. By injecting encoded traversal sequences such as '%c0%ae%c0%ae' into the request path, attackers can bypass input validation and disclose sensitive files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Linknat Technology
product: VOS Manager
default_status: unaffected
Credits: lang: en
value: zqsky of WooYun
Published: 2025-07-16T21:03:53.676Z
CVE-2025-34119 EasyCafe Server 2.2.14 Remote File Disclosure via Opcode 0x43
A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens for a custom protocol where opcode 0x43 can be used to request arbitrary files by absolute path. If the file exists and is accessible, its content is returned without authentication. This flaw allows attackers to retrieve sensitive files such as system configuration, password files, or application data.
Problem types: cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Tinasoft
product: EasyCafe Server
default_status: unknown
Credits: lang: en
value: R-73eN
Published: 2025-07-16T21:04:35.633Z
CVE-2025-34120 LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload
An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (`index.php/admin/update/sa/backup`), allowing attackers to specify arbitrary file paths using a crafted `datasupdateinfo` payload. The files are packaged in a ZIP archive and made available for download without authentication. This vulnerability can be exploited to read arbitrary files on the host system, including sensitive OS and configuration files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: LimeSurvey GmbH
product: LimeSurvey
default_status: unaffected
Credits: lang: en
value: Pichaya Morimoto
Published: 2025-07-16T21:05:34.816Z
CVE-2025-34121 Idera Up.Time ≤ 7.2 post2file.php Arbitrary File Upload RCE
An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php` script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in remote code execution as the web server user. NOTE: The bypass for this vulnerability is tracked as CVE-2015-9263.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Idera
product: Up.Time Monitoring Station
default_status: unaffected
Credits: lang: en
value: Denis Andzakovic of Security-Assessment.com
Published: 2025-07-16T21:06:44.747Z
CVE-2025-34123 VideoCharge Studio 2.12.3.685 SEH Buffer Overflow via .VSC File
A stack-based buffer overflow vulnerability exists in VideoCharge Studio 2.12.3.685 when processing a specially crafted .VSC configuration file. The issue occurs due to improper handling of user-supplied data in the XML 'Name' attribute, leading to an SEH overwrite condition. An attacker can exploit this vulnerability by convincing a user to open a malicious .VSC file, resulting in arbitrary code execution under the context of the user.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: VideoCharge Software
product: Studio
default_status: unknown
Credits: lang: en
value: metacom
Published: 2025-07-16T21:07:50.606Z
CVE-2025-34124 Heroes of Might and Magic III .h3m Map File Buffer Overflow
A buffer overflow vulnerability exists in Heroes of Might and Magic III Complete 4.0.0.0, HD Mod 3.808 build 9, and Demo 1.0.0.0 via malicious .h3m map files that exploit object sprite name parsing logic. The vulnerability occurs during in-game map loading when a crafted object name causes a buffer overflow, potentially allowing arbitrary code execution. Exploitation requires the victim to open a malicious map file within the game.
Problem types: cwe_id: CWE-121
description: CWE-121  Stack-based Buffer Overflow
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: The 3DO Company
product: Heroes of Might and Magic III
default_status: unaffected
Credits: lang: en
value: Pierre Lindblad
lang: en
value: John AAkerblo
Published: 2025-07-16T21:08:33.123Z
CVE-2025-34125 D-Link DSP-W110A1 Cookie Command Injection
An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B01. This occurs when specially crafted cookie values are processed, allowing remote attackers to execute arbitrary commands on the underlying Linux operating system. Successful exploitation enables full system compromise.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: D-Link
product: DSP-W110A1
default_status: unaffected
Credits: lang: en
value: Peter Adkins
Published: 2025-07-16T21:09:59.215Z
CVE-2025-34126 RIPS Scanner v0.54 Path Traversal
A path traversal vulnerability exists in RIPS Scanner version 0.54. The vulnerability allows remote attackers to read arbitrary files on the system with the privileges of the web server by sending crafted HTTP GET requests to the 'windows/code.php' script with a manipulated 'file' parameter. This can lead to disclosure of sensitive information.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: RIPS Technologies
product: RIPS Scanner
default_status: affected
Credits: lang: en
value: localh0t
Published: 2025-07-16T21:10:13.388Z
CVE-2025-34127 Achat v0.150 SEH Buffer Overflow via UDP
A stack-based buffer overflow exists in Achat v0.150 in its default configuration. By sending a specially crafted message to the UDP port 9256, an attacker can overwrite the structured exception handler (SEH) due to insufficient bounds checking on user-supplied input leading to remote code execution.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Achat Software
product: Achat Chat Server
default_status: unknown
Credits: lang: en
value: Peter Kasza
Published: 2025-07-16T21:10:22.494Z
CVE-2025-34128 X360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()
A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6 when handling overly long arguments to the ConvertFile() method. An attacker can exploit this vulnerability by supplying crafted input to cause memory corruption and execute arbitrary code within the context of the current process.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: X360Soft
product: X360 VideoPlayer ActiveX Control
default_status: unknown
Credits: lang: en
value: Rh0
Published: 2025-07-16T21:10:31.205Z
CVE-2025-34129 LILIN DVR RCE via Malicious FTP/NTP Configuration
A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 due to insufficient sanitization of the FTP and NTP Server fields in the service configuration. An attacker with access to the configuration interface can upload a malicious XML file with injected shell commands in these fields. Upon subsequent configuration syncs, these commands are executed with elevated privileges. This vulnerability was exploited in the wild by the Moobot botnets.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Merit LILIN
product: DVR Firmware
default_status: unaffected
Credits: lang: en
value: 360 Netlab
Published: 2025-07-16T21:26:32.446Z
CVE-2025-34130 LILIN DVR Arbitrary File Read via net_html.cgi
An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the /z/zbin/net_html.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be used to facilitate further attacks including command injection. The vulnerability has been exploited in the wild in conjunction with other issues by botnets like FBot and Moobot.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Merit LILIN
product: DVR Firmware
default_status: unaffected
Credits: lang: en
value: 360 Netlab
Published: 2025-07-16T21:26:42.449Z
CVE-2025-34132 LILIN DVR Command Injection via NTPUpdate in dvr_box
A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NTPUpdate configuration. The web service at /z/zbin/dvr_box fails to properly sanitize input, allowing remote attackers to inject and execute arbitrary commands as root by supplying specially crafted XML data to the DVRPOST interface.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Merit LILIN
product: DVR Firmware
default_status: unaffected
Credits: lang: en
value: 360 Netlab
Published: 2025-07-16T21:26:51.852Z
CVE-2025-34133 Wimi Teamwork < v7.38.17 CSRF
Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrf_token' without validating the field’s value; only the presence of the field is checked. An attacker can craft a cross-site request that causes a logged-in victim’s browser to submit a JSON POST containing an arbitrary or empty 'csrf_token', and the API will execute the request with the victim’s privileges. Successful exploitation can allow an attacker to perform privileged actions as the victim potentially resulting in account takeover, privilege escalation, or service disruption.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Cloud Solutions SAS
product: Wimi Teamwork
default_status: unaffected
Credits: lang: en
value: Noa Tchoumak
Published: 2025-10-27T15:13:06.704Z
CVE-2025-34134 Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)
Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters (notably bpi_logfile and bpi_configfile) allow an authenticated administrative user to cause the product to create or overwrite files within the webroot and subsequently edit them via the BPI configuration editor. When such files carry executable extensions and are served by the web application, arbitrary code may be executed in the context of the web application user. Successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain further control of the underlying host operating system.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Credits: lang: en
value: M. Cory Billington of theyhack.me
Published: 2025-10-30T21:41:58.188Z
CVE-2025-34135 Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files
Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Nagios
product: XI
default_status: unaffected
Published: 2025-10-30T21:39:22.649Z
CVE-2025-34136 Commvault CommServe Web Server Unauthenticated SQL Injection
An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same environment are not affected.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Commvault
product: Commvault
default_status: unaffected
Published: 2025-07-25T15:49:23.837Z
CVE-2025-34139 Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read
A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Sitecore
product: Experience Manager (XM)
default_status: unaffected
vendor: Sitecore
product: Experience Platform (XP)
default_status: unaffected
vendor: Sitecore
product: Experience Commerce (XC)
default_status: unaffected
vendor: Sitecore
product: Managed Cloud
default_status: unaffected
Credits: lang: en
value: Sitecore
Published: 2025-07-25T15:54:25.297Z
CVE-2025-34140 ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix
An authorization bypass vulnerability exists in ETQ Reliance (legacy CG and NXG SaaS platforms). By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration in API authorization logic, which has since been corrected in SE.2025.1 and 2025.1.2.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: ETQ
product: Reliance CG (legacy)
default_status: unaffected
vendor: ETQ
product: Reliance NXG (SaaS)
default_status: unaffected
Credits: lang: en
value: Adam Kues and Shubham Shah of Assetnote
Published: 2025-07-22T12:34:31.324Z
CVE-2025-34141 ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`
A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The affected servlet was unnecessarily exposed to authenticated users and has since been disabled in version SE.2025.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
cwe_id: CWE-116
description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: ETQ
product: Reliance CG (legacy)
default_status: unaffected
Credits: lang: en
value: Adam Kues and Shubham Shah of Assetnote
Published: 2025-07-22T12:35:57.509Z