rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-41074 Multiple vulnerabilities in Limesurvey
Vulnerability in LimeSurvey 6.13.0  in the endpoint /optout that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS  attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability.
Problem types: cwe_id: CWE-835
description: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: LimeSurvey
product: LimeSurvey
default_status: unaffected
Credits: lang: en
value: Julen Garrido Estevez
Published: 2025-11-20T12:47:05.559Z
CVE-2025-41075 Multiple vulnerabilities in Limesurvey
Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS  attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability.
Problem types: cwe_id: CWE-835
description: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: LimeSurvey
product: LimeSurvey
default_status: unaffected
Credits: lang: en
value: Julen Garrido Estevez
Published: 2025-11-20T12:49:29.997Z
CVE-2025-41076 Multiple vulnerabilities in Limesurvey
In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: LimeSurvey
product: LimeSurvey
default_status: unaffected
Credits: lang: en
value: Julen Garrido Estevez
Published: 2025-11-20T12:52:25.797Z
CVE-2025-41077 Multiple vulnerabilities in Viafirma products
IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access and modify their data. This allows the user's email addresses to be modified and, subsequently, using the password recovery functionality to access the application by impersonating any user, including those with administrative permissions.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Viafirma
product: Inbox
default_status: unaffected
Credits: lang: en
value: Carlos Aguadé Cabañas
Published: 2026-01-12T14:54:51.852Z
CVE-2025-41078 Multiple vulnerabilities in Viafirma products
Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modification, and deletion features, and escalate privileges by impersonating other users of the application in the generation and signing of documents.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Viafirma
product: Viafirma Documents
default_status: unaffected
Credits: lang: en
value: Carlos Aguadé Cabañas
Published: 2026-01-12T14:59:26.385Z
CVE-2025-41079 Multiple vulnerabilities in Seafile
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Seafile
product: Seafile
default_status: unaffected
Credits: lang: en
value: Arnau Sola López and Arnau Yepes Huguet
Published: 2025-12-04T11:48:10.112Z
CVE-2025-41080 Multiple vulnerabilities in Seafile
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with POST parámetro 'p' in '/api/v2.1/repos/{repo_id}/file/'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Seafile
product: Seafile
default_status: unaffected
Credits: lang: en
value: Arnau Sola López and Arnau Yepes Huguet
Published: 2025-12-04T11:48:44.776Z
CVE-2025-41081 Reflected Cross-Site Scripting (XSS) in IsMyGym
Reflected Cross-Site Scripting (XSS) vulnerability in IsMyGym by Zuinq Studio. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL with '/<PATH>.php/<XSS>'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Problem types: description: 79
Affected products: vendor: Zuinq Studio
product: IsMyGym
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-01-20T12:11:33.663Z
CVE-2025-41082 HTTP Request/Response Smuggling in Altitude Communication Server
Illegal HTTP request traffic vulnerability (CL.0) in Altitude Communication Server, caused by inconsistent analysis of multiple HTTP requests over a single Keep-Alive connection using  Content-Length headers. This can cause a desynchronization of requests between frontend and backend servers, which could allow request hiding, cache poisoning or security bypass.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: vendor: Altitude
product: Altitude Communication Server
default_status: unaffected
Credits: lang: en
value: Julen Garrido Estevez
Published: 2026-01-26T09:24:20.607Z
CVE-2025-41083 Improper Neutralization in Altitude Communication Server
Vulnerability in Altitude Authentication Service and Altitude Communication Server v8.5.3290.0 by Altitude, where manipulation of Host header in HTTP requests allows redirection to an arbitrary URL or modification of the base URL to trick the victim into sending login credentials to a malicious website. This behavior can be used to redirect clients to endpoints controlled by the attacker.
Problem types: cwe_id: CWE-74
description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Altitude
product: Altitude Communication Server
default_status: unaffected
Credits: lang: en
value: Julen Garrido Estevez
Published: 2026-01-26T09:42:42.532Z
CVE-2025-41084 Stored Cross-Site Scripting (XSS) in Sesame web application
Stored Cross-Site Scripting (XSS) vulnerability in Sesame web application, due to the fact that uploaded SVG images are not properly sanitized. This allows attackers to embed malicious scripts in SVG files by sending a POST request using the 'logo' parameter in '/api/v3/companies/<ID>/logo', which are then stored on the server and executed in the context of any user who accesses the compromised resource.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: SESAME LABS S.L
product: Sesame
default_status: unaffected
Credits: lang: en
value: Miguel Jiménez Cámara
Published: 2026-01-20T09:14:40.629Z
CVE-2025-41085 Stored Cross-Site Scripting (XSS) in Apidog web platform
Stored Cross-Site Scripting (XSS) vulnerability type in Apidog  in the version 2.7.15, where SVG image uploads are not properly sanitized. This allows attackers to embed malicious scripts in SVG files by sending a POST request to '/api/v1/user-avatar', which are then stored on the server and executed in the context of any user accessing the compromised resource.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Apidog
product: Apidog Web Platform
default_status: unaffected
Credits: lang: en
value: Miguel Jiménez Cámara
Published: 2026-02-04T09:56:45.513Z
CVE-2025-41086 Authorization bypass in GAMS from GAMS Development Corp.
Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculate the checksum and generate a valid license to grant themselves full privileges without credentials or access to the source code, allowing them unrestricted access to GAMS's mathematical models and commercial solvers.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: AMS Development Corp.
product: GAMS
default_status: unaffected
Credits: lang: en
value: Juan Embid Sánchez
lang: en
value: Francisco Guerrero Gallardo
Published: 2025-12-02T13:22:23.415Z
CVE-2025-41087 Cross-Site Scripting (XSS) stored in Taclia's web application
Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the attackers to embed malicious scripts in SVG files such as image profiles, which are then stored on the server and executed in the context of any user who accesses the compromised resource.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Taclia
product: Taclia's web application
default_status: unaffected
Credits: lang: en
value: Miguel Jiménez Cámara
Published: 2025-11-24T11:27:59.851Z
CVE-2025-41088 Stored Cross-Site Scripting (XSS) in CMS
Stored Cross-Site Scripting (XSS) in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Elements' section, and finally modify the 'Text' field in the section with the malicious payload.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Xibo Signage
product: Xibo CMS
default_status: unaffected
Credits: lang: en
value: Marina Fabregat Expósito
Published: 2025-10-10T09:17:32.807Z
CVE-2025-41089 Reflected Cross-Site Scripting (XSS) in CMS
Reflected Cross-Site Scripting (XSS) in Xibo CMS v4.1.2 from Xibo Signage, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add an element that has the 'Configuration Name' field, such as the 'Clock' widget. Next, modify the 'Configuration Name' field in the left-hand section.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Xibo Signage
product: Xibo CMS
default_status: unaffected
Credits: lang: en
value: Marina Fabregat Expósito
Published: 2025-10-10T09:19:18.138Z
CVE-2025-41090 Improper Access Control in CCN-CERT microCLAUDIA
microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability.

This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a compromised endpoint or deduced manually.

This vulnerability allows access between tenants, enabling an attacker to list and manage remote assets, uninstall agents, and even delete vaccines configurations.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: CCN-CERT
product: microCLAUDIA
default_status: unaffected
Credits: lang: en
value: Alejandro Vázquez Vázquez
Published: 2025-10-28T09:17:08.128Z
CVE-2025-41091 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to calendar details using unauthorised internal identifiers.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: GLOBAL PLANNING SOLUTIONS S.L (GPS)
product: BOLD Workplanner
default_status: unaffected
Credits: lang: en
value: Ángel González
Published: 2025-09-30T11:10:49.088Z
CVE-2025-41092 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to time records details using unauthorised internal identifiers.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: GLOBAL PLANNING SOLUTIONS S.L (GPS)
product: BOLD Workplanner
default_status: unaffected
Credits: lang: en
value: Ángel González
Published: 2025-09-30T11:12:59.221Z
CVE-2025-41093 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic contract details using unauthorised internal identifiers.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: GLOBAL PLANNING SOLUTIONS S.L (GPS)
product: BOLD Workplanner
default_status: unaffected
Credits: lang: en
value: Ángel González
Published: 2025-09-30T11:13:48.555Z
CVE-2025-41094 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to functional contract details using unauthorised internal identifiers.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: GLOBAL PLANNING SOLUTIONS S.L (GPS)
product: BOLD Workplanner
default_status: unaffected
Credits: lang: en
value: Ángel González
Published: 2025-09-30T11:14:33.108Z
CVE-2025-41095 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to planning counter details using unauthorised internal identifiers.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: GLOBAL PLANNING SOLUTIONS S.L (GPS)
product: BOLD Workplanner
default_status: unaffected
Credits: lang: en
value: Ángel González
Published: 2025-09-30T11:15:55.509Z
CVE-2025-41096 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the dates of the current contract details using unauthorised internal identifiers.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: GLOBAL PLANNING SOLUTIONS S.L (GPS)
product: BOLD Workplanner
default_status: unaffected
Credits: lang: en
value: Ángel González
Published: 2025-09-30T11:16:31.984Z
CVE-2025-41097 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic employee  details using unauthorised internal identifiers.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: GLOBAL PLANNING SOLUTIONS S.L (GPS)
product: BOLD Workplanner
default_status: unaffected
Credits: lang: en
value: Ángel González
Published: 2025-09-30T11:16:55.358Z
CVE-2025-41098 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a  misuse of the general enquiry web service.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: GLOBAL PLANNING SOLUTIONS S.L (GPS)
product: BOLD Workplanner
default_status: unaffected
Credits: lang: en
value: Ángel González
Published: 2025-09-30T11:18:20.965Z
CVE-2025-41099 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the list of permissions using unauthorised internal identifiers.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: GLOBAL PLANNING SOLUTIONS S.L (GPS)
product: BOLD Workplanner
default_status: unaffected
Credits: lang: en
value: Ángel González
Published: 2025-09-30T11:17:30.044Z
CVE-2025-41100 Incorrect authentication in ParkingDoor
Incorrect authentication vulnerability in ParkingDoor. Through this vulnerability it is possible to operate the device without the access being logged in the application and even if the access permissions have been revoked.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: ParkingDoor
product: ParkingDoor
default_status: unaffected
Credits: lang: en
value: Carlos Galean
Published: 2025-07-21T12:47:37.305Z
CVE-2025-41101 Multiple vulnerabilities in Fairsketch's RISE CRM Framework
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in'/projects/save'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Fairsketch
product: RISE CRM Framework
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-11-11T11:50:20.221Z
CVE-2025-41102 Multiple vulnerabilities in Fairsketch's RISE CRM Framework
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/events/save'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Fairsketch
product: RISE CRM Framework
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-11-11T11:57:40.402Z
CVE-2025-41103 Multiple vulnerabilities in Fairsketch's RISE CRM Framework
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'reply_message' in '/messages/reply'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Fairsketch
product: RISE CRM Framework
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-11-11T12:16:38.712Z
CVE-2025-41104 Multiple vulnerabilities in Fairsketch's RISE CRM Framework
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'custom_field_1' in '/estimate_requests/save_estimate_request'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Fairsketch
product: RISE CRM Framework
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-11-11T12:17:41.493Z
CVE-2025-41105 Multiple vulnerabilities in Fairsketch's RISE CRM Framework
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/tickets/save'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Fairsketch
product: RISE CRM Framework
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-11-11T12:19:05.637Z
CVE-2025-41106 Multiple vulnerabilities in Fairsketch's RISE CRM Framework
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'first_name' in '/clients/save_contact/'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Fairsketch
product: RISE CRM Framework
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-11-11T12:21:07.211Z
CVE-2025-41107 Stored XSS in Smart School
Stored Cross Site Scripting (XSS) vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/online_admission', wich affects the parameters 'firstname', 'lastname', 'guardian_name' and others. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal his/her session cookie details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: QDOCS
product: Smart Schoo
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-11-10T09:09:31.598Z