rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-24499 
A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V3.0.0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) (All versions < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V3.0.0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) (All versions < V3.0.0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) (All versions < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V3.0.0). Affected devices do not properly validate input while loading the configuration files. This could allow an authenticated remote attacker to execute arbitrary shell commands on the device.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Siemens
product: SCALANCE WAB762-1
default_status: unknown
vendor: Siemens
product: SCALANCE WAM763-1
default_status: unknown
vendor: Siemens
product: SCALANCE WAM763-1 (ME)
default_status: unknown
vendor: Siemens
product: SCALANCE WAM763-1 (US)
default_status: unknown
vendor: Siemens
product: SCALANCE WAM766-1
default_status: unknown
vendor: Siemens
product: SCALANCE WAM766-1 (ME)
default_status: unknown
vendor: Siemens
product: SCALANCE WAM766-1 (US)
default_status: unknown
vendor: Siemens
product: SCALANCE WAM766-1 EEC
default_status: unknown
vendor: Siemens
product: SCALANCE WAM766-1 EEC (ME)
default_status: unknown
vendor: Siemens
product: SCALANCE WAM766-1 EEC (US)
default_status: unknown
vendor: Siemens
product: SCALANCE WUB762-1
default_status: unknown
vendor: Siemens
product: SCALANCE WUB762-1 iFeatures
default_status: unknown
vendor: Siemens
product: SCALANCE WUM763-1
default_status: unknown
vendor: Siemens
product: SCALANCE WUM763-1
default_status: unknown
vendor: Siemens
product: SCALANCE WUM763-1 (US)
default_status: unknown
vendor: Siemens
product: SCALANCE WUM763-1 (US)
default_status: unknown
vendor: Siemens
product: SCALANCE WUM766-1
default_status: unknown
vendor: Siemens
product: SCALANCE WUM766-1 (ME)
default_status: unknown
vendor: Siemens
product: SCALANCE WUM766-1 (USA)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.2
baseSeverity: HIGH
Published: 2025-02-11T10:29:05.987Z
CVE-2025-24500 
The vulnerability allows an unauthenticated attacker to access information in PAM database.
Affected products: vendor: Broadcom
product: Symantec Privileged Access Management
default_status: affected
Credits: lang: en
value: Stefan Grönke (gronke@radicallyopensecurity.com)
Published: 2025-01-30T18:15:12.337Z
CVE-2025-24501 
An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Broadcom
product: Symantec Privileged Access Management
default_status: affected
Credits: lang: en
value: Stefan Grönke (gronke@radicallyopensecurity.com)
Published: 2025-01-30T18:21:37.817Z
CVE-2025-24502 
An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address.
Affected products: vendor: Broadcom
product: Symantec Privileged Access Management
default_status: affected
Credits: lang: en
value: Stefan Grönke (gronke@radicallyopensecurity.com)
Published: 2025-01-30T18:24:32.902Z
CVE-2025-24503 
A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.
Affected products: vendor: Broadcom
product: Symantec Privileged Access Management
default_status: affected
Credits: lang: en
value: Stefan Grönke (gronke@radicallyopensecurity.com)
Published: 2025-01-30T18:27:08.641Z
CVE-2025-24504 
An improper input validation the CSRF filter results in unsanitized user input written to the application logs.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Broadcom
product: Symantec Privileged Access Management
default_status: affected
Credits: lang: en
value: Stefan Grönke (gronke@radicallyopensecurity.com)
Published: 2025-01-30T18:31:41.795Z
CVE-2025-24505 
This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially crafted upgrade file.
Affected products: vendor: Broadcom
product: Symantec Privileged Access Management
default_status: affected
Credits: lang: en
value: Stefan Grönke (gronke@radicallyopensecurity.com)
Published: 2025-01-30T18:36:09.450Z
CVE-2025-24506 
A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.
Affected products: vendor: Broadcom
product: Symantec Privileged Access Management
default_status: affected
Credits: lang: en
value: Stefan Grönke (gronke@radicallyopensecurity.com)
Published: 2025-01-30T18:39:19.670Z
CVE-2025-24507 
This vulnerability allows appliance compromise at boot time.
Affected products: vendor: Broadcom
product: Symantec Privileged Access Management
default_status: affected
Credits: lang: en
value: Stefan Grönke (gronke@radicallyopensecurity.com)
Published: 2025-01-30T18:41:50.906Z
CVE-2025-24508 Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite
Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage
Affected products: vendor: Broadcom
product: Symantec IT Management Suite
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-07-07T04:54:31.638Z
CVE-2025-24510 
A vulnerability has been identified in MS/TP Point Pickup Module (All versions). Affected devices improperly handle specific incoming BACnet MSTP messages. This could allow an attacker residing in the same BACnet network to send a specially crafted MSTP message that results in a denial of service condition of the targeted device. A power cycle is required to restore the device's normal operation.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Siemens
product: MS/TP Point Pickup Module
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2025-05-13T09:38:33.128Z
CVE-2025-24511 
Improper initialization in the Linux kernel-mode driver for some Intel(R) I350 Series Ethernet before version 5.19.2 may allow an authenticated user to potentially enable Information disclosure via data exposure.
Problem types: description: Information Disclosure
cwe_id: CWE-665
description: Improper Initialization
Affected products: vendor: n/a
product: Intel(R) I350 Series Ethernet
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.3
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
Published: 2025-08-12T16:59:02.313Z
CVE-2025-24512 
Improper input validation for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Authorized adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.
Problem types: description: Denial of Service
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi Software for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2025-11-11T16:49:49.044Z
CVE-2025-24513 ingress-nginx controller - auth secret file path traversal vulnerability
A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: kubernetes
product: ingress-nginx
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Credits: lang: en
value: Nir Ohfeld
lang: en
value: Ronen Shustin
Published: 2025-03-24T23:29:25.215Z
CVE-2025-24514 ingress-nginx controller - configuration injection via unsanitized auth-url annotation
A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: kubernetes
product: ingress-nginx
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Nir Ohfeld
lang: en
value: Ronen Shustin
lang: en
value: Sagi Tzadik
Published: 2025-03-24T23:29:36.802Z
CVE-2025-24515 
NULL pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
cwe_id: CWE-476
description: NULL Pointer Dereference
Affected products: vendor: n/a
product: Intel(R) Graphics Drivers
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2025-08-12T16:59:03.914Z
CVE-2025-24516 
Improper access control for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Information Disclosure
cwe_id: CWE-284
description: Improper Access Control
Affected products: vendor: n/a
product: Intel(R) CIP software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
Published: 2025-11-11T16:49:50.705Z
CVE-2025-24517 
Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a remote attacker may obtain the product login password without authentication.
Problem types: cwe_id: CWE-603
description: Use of client-side authentication
Affected products: vendor: Inaba Denki Sangyo Co., Ltd.
product: CHOCO TEI WATCHER mini (IB-MCT001)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2025-03-31T04:48:57.473Z
CVE-2025-24519 
Buffer overflow for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-120
description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: n/a
product: Intel(R) QAT Windows software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
Published: 2025-11-11T16:49:52.249Z
CVE-2025-24520 
Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2514.7.16.0 may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: Information Disclosure
cwe_id: CWE-532
description: Insertion of Sensitive Information into Log File
Affected products: vendor: n/a
product: Intel(R) Local Manageability Service software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.3
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
Published: 2025-08-12T16:59:05.502Z
CVE-2025-24521 Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference
External XML entity injection allows arbitrary download of files. The 
score without least privilege principle violation is as calculated 
below. In combination with other issues it may facilitate further 
compromise of the device. Remediation in Version 6.8.0, release date: 
01-Mar-25.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: Keysight
product: Ixia Vision Product Family
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: NATO Cyber Security Centre (NCSC) reported these vulnerabilities to Keysight.
Published: 2025-03-05T15:17:23.659Z
CVE-2025-24522 KUNBUS Revolution Pi  Authentication Bypass by Primary Weakness
KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system.
Problem types: cwe_id: CWE-305
description: CWE-305
Affected products: vendor: KUNBUS GmbH
product: Revolution Pi OS Bookworm
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Adam Bromiley of Pen Test Partners reported these vulnerabilities to CISA.
Published: 2025-05-01T18:37:37.244Z
CVE-2025-24523 
Protection mechanism failure for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
Problem types: description: Denial of Service
cwe_id: CWE-693
description: Protection Mechanism Failure
Affected products: vendor: n/a
product: Edge Orchestrator software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.5
baseSeverity: LOW
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
Published: 2025-08-12T16:59:07.037Z
CVE-2025-24525 Keysight Ixia Vision Product Family Use of Hard-coded Cryptographic Key
Keysight Ixia Vision has an issue with hardcoded cryptographic material 
which may allow an attacker to intercept or decrypt payloads sent to the
 device via API calls or user authentication if the end user does not 
replace the TLS certificate that shipped with the device. Remediation is
 available in Version 6.9.1, released on September 23, 2025.
Problem types: cwe_id: CWE-321
description: CWE-321
Affected products: vendor: Keysight
product: Ixia Vision Product Family
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: NATO Cyber Security Centre (NCSC) reported these vulnerabilities to Keysight.
Published: 2025-09-30T23:04:14.688Z
CVE-2025-24526 Channel export permitted on archived channel when viewing archived channels is disabled
Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access to it
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Eva Sarafianou
Published: 2025-02-24T07:23:23.331Z
CVE-2025-24527 
An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connector GUID, they can execute debug commands on that connector.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Akamai
product: Enterprise Application Access
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Published: 2025-01-29T00:00:00.000Z
CVE-2025-24528 
In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: MIT
product: Kerberos 5
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H
Published: 2026-01-16T00:00:00.000Z
CVE-2025-24529 
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: phpMyAdmin
product: phpMyAdmin
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-01-23T00:00:00.000Z
CVE-2025-24530 
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: phpMyAdmin
product: phpMyAdmin
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-01-23T00:00:00.000Z
CVE-2025-24531 
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.
Problem types: cwe_id: CWE-393
description: CWE-393 Return of Wrong Status Code
Affected products: vendor: OpenSC project
product: pam_pkcs11
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: 2026-01-16T00:00:00.000Z