rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-34080 CONPROSYS HMI System (CHS) < 3.7.7 Reflected Cross-Site Scripting
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable to Cross-Site Scripting (XSS) in the getqsetting.php functionality that could allow reflected execution of scripts in the browser on interaction.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Contec Co.,Ltd.
product: CONPROSYS HMI System (CHS)
default_status: affected
Credits: lang: en
value: Alex Williams of Converge Technology Solutions
Published: 2025-07-01T17:51:53.979Z
CVE-2025-34081 CONPROSYS HMI System (CHS) < 3.7.7 Exposed PHP Debug Info
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
Problem types: cwe_id: CWE-215
description: CWE-215 Insertion of Sensitive Information Into Debugging Code
Affected products: vendor: Contec Co.,Ltd.
product: CONPROSYS HMI System (CHS)
default_status: affected
Credits: lang: en
value: Alex Williams of Converge Technology Solutions
Published: 2025-07-01T17:56:56.073Z
CVE-2025-34082 IGEL OS Secure Terminal and Secure Shadow Remote Code Execution
A command injection vulnerability exists in IGEL OS versions prior to 11.04.270 within the Secure Terminal and Secure Shadow services. The flaw arises due to improper input sanitization in the handling of specially crafted PROXYCMD commands on TCP ports 30022 and 5900. An unauthenticated attacker with network access to a vulnerable device can inject arbitrary commands, leading to remote code execution with elevated privileges.

NOTE: IGEL OS v10.x has reached end-of-life (EOL) status.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: IGEL Technology GmbH
product: OS
default_status: unaffected
Credits: lang: en
value: Rob Vinson of NCC Group
Published: 2025-07-03T19:46:27.555Z
CVE-2025-34086 Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file.

NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Bolt
product: CMS
default_status: unaffected
Credits: lang: en
value: Sivanesh Ashok
Published: 2025-07-03T19:46:16.190Z
CVE-2025-34087 Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution
An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user.




This behavior was present in the legacy AdminLTE interface and has since been patched in later versions.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Pi-hole LLC
product: Web
default_status: unaffected
Credits: lang: en
value: Denis Andzakovic
Published: 2025-07-03T19:46:49.017Z
CVE-2025-34088 Pandora FMS Authenticated Remote Code Execution via Ping Module
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Artica ST
product: Pandora FMS
default_status: unaffected
Credits: lang: en
value: Onur ER
Published: 2025-07-03T19:46:38.590Z
CVE-2025-34089 Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled (i.e., the "Allow unknown devices" option is enabled), the /api/executeScript endpoint is exposed without access control. This allows unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in code execution using do shell script. Successful exploitation grants attackers the ability to run arbitrary commands on the macOS host with the privileges of the Remote for Mac background process.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Aexol Studio
product: Remote for Mac
default_status: unaffected
Credits: lang: en
value: Chokri Hammedi
Published: 2025-07-03T19:47:00.455Z
CVE-2025-34093 Polycom HDX Series Telnet Command Injection via lan traceroute
An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in the devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system commands. By injecting shell metacharacters through the traceroute interface, an attacker can achieve remote code execution under the context of the root user. This flaw affects systems where Telnet access is enabled and either unauthenticated access is allowed or credentials are known.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Polycom
product: HDX Series
default_status: unaffected
Credits: lang: en
value: Etienne Stalmans of Staaldraad
Published: 2025-07-10T19:13:44.410Z
CVE-2025-34095 Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp
An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute() code, which is then persisted on disk and triggered via a subsequent GET request to examples/manage.lsp. This allows remote command execution on the underlying operating system, impacting both Windows and Unix-based deployments.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Real Time Logic
product: Mako Server
default_status: unaffected
Credits: lang: en
value: John Page (hyp3rlinx) of Beyond Security SecuriTeam Secure Disclosure
Published: 2025-07-10T19:14:30.933Z
CVE-2025-34096 Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghp
A stack-based buffer overflow vulnerability exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered when a crafted POST request is sent to the /sendemail.ghp endpoint containing an overly long Email parameter. The application fails to properly validate the length of this field, resulting in a memory corruption condition. An unauthenticated remote attacker can exploit this to execute arbitrary code with the privileges of the server process.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: EFS Software Inc.
product: Easy File Sharing HTTP Server
default_status: unknown
Credits: lang: en
value: bl4ck h4ck3r
Published: 2025-07-10T19:15:06.156Z
CVE-2025-34097 ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE
An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 — a privilege escalation flaw in the user profile page — to achieve full remote code execution from a low-privileged account.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: ProcessMaker Inc.
product: ProcessMaker
default_status: unaffected
Credits: lang: en
value: bcoles
Published: 2025-07-10T19:12:37.309Z
CVE-2025-34098 Riverbed SteelHead VCX Authenticated Arbitrary File Read via Log Filter Injection
A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting crafted filter expressions to the log_filter endpoint using the filterStr parameter. This input is processed by a backend parser that permits execution of file expansion syntax, allowing the attacker to retrieve arbitrary system files via the log viewing interface.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Riverbed Technology
product: SteelHead VCX
default_status: unaffected
Credits: lang: en
value: Gregory Draperi
Published: 2025-07-10T19:11:52.790Z
CVE-2025-34099 VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Password
An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: VICIdial Group
product: VICIdial
default_status: unaffected
Credits: lang: en
value: bcoles
Published: 2025-07-10T19:10:18.695Z
CVE-2025-34100 BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload
An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upload plugin. The plugin fails to properly validate or restrict file types or locations during upload operations, allowing an attacker to upload a malicious .php file and subsequently execute arbitrary PHP code on the server under the context of the web server process. While the root vulnerability lies within the jQuery File Upload component, BuilderEngine’s improper integration and lack of access controls expose this functionality to unauthenticated users, resulting in full remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: BuilderEngine
product: CMS
default_status: unknown
Credits: lang: en
value: metanubix
Published: 2025-07-10T19:16:28.782Z
CVE-2025-34101 Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter
An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed by the console component (default port 23423). The checkStreamUrl method accepts a VIDEO parameter that is passed unsanitized to a call to cmd.exe, enabling arbitrary command execution under the privileges of the web server. No authentication is required to exploit this issue, as the REST API is exposed by default and lacks access controls.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Serviio
product: Media Server
default_status: unaffected
Credits: lang: en
value: Gjoko Krstic of Zero Science Lab
Published: 2025-07-10T19:11:05.353Z
CVE-2025-34102 CryptoLog Unauthenticated RCE via SQL Injection and Command Injection
A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command injection vulnerabilities. An unauthenticated attacker can gain shell access as the web server user by first exploiting a SQL injection flaw in login.php to bypass authentication, followed by command injection in logshares_ajax.php to execute arbitrary operating system commands.


The login bypass is achieved by submitting crafted SQL via the user POST parameter. Once authenticated, the attacker can abuse the lsid POST parameter in the logshares_ajax.php endpoint to inject and execute a command using $(...) syntax, resulting in code execution under the web context.


This exploitation path does not exist in the ASP.NET version of CryptoLog released since 2009.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Crypttech
product: CryptoLog
default_status: unaffected
Credits: lang: en
value: Mehmet Ince
Published: 2025-07-10T19:16:01.206Z
CVE-2025-34103 WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi
An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticated remote attacker to execute arbitrary commands as the web server user.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: WePresent (Barco)
product: WiPG-1000
default_status: unknown
Credits: lang: en
value: Matthias Brun of Redguard
Published: 2025-07-15T13:10:41.256Z
CVE-2025-34104 Piwik Authenticated RCE via Custom Plugin Upload
An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Piwik (now Matomo)
product: Web Analytics Platform
default_status: unaffected
Credits: lang: en
value: FireFart
Published: 2025-07-15T13:06:51.072Z
CVE-2025-34105 DiskBoss Enterprise Stack-Based Buffer Overflow RCE
A stack-based buffer overflow vulnerability exists in the built-in web interface of DiskBoss Enterprise versions 7.4.28, 7.5.12, and 8.2.14. The vulnerability arises from improper bounds checking on the path component of HTTP GET requests. By sending a specially crafted long URI, a remote unauthenticated attacker can trigger a buffer overflow, potentially leading to arbitrary code execution with SYSTEM privileges on vulnerable Windows hosts.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Flexense
product: DiskBoss Enterprise
default_status: unaffected
Credits: lang: en
value: vportal
lang: en
value: Ahmad Mahfouz
Published: 2025-07-15T13:02:06.618Z
CVE-2025-34106 PDF Shaper v3.5/3.6 Buffer Overflow via Convert to Image Feature
A buffer overflow vulnerability exists in PDF Shaper versions 3.5 and 3.6 when converting a crafted PDF file to an image using the 'Convert PDF to Image' functionality. An attacker can exploit this vulnerability by tricking a user into opening a maliciously crafted PDF file, leading to arbitrary code execution under the context of the user. This vulnerability has been verified on Windows XP, 7, 8, and 10 platforms using the PDFTools.exe component.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Burnaware
product: PDF Shaper
default_status: unknown
Credits: lang: en
value: metacom
Published: 2025-07-15T13:05:49.222Z
CVE-2025-34107 WinaXe 7.7 FTP Client Remote Buffer Overflow
A buffer overflow vulnerability exists in the WinaXe FTP Client version 7.7 within the FTP banner parsing functionality, WCMDPA10.dll. When the client connects to a remote FTP server and receives an overly long '220 Server Ready' response, the vulnerable component responsible for parsing the banner overflows a stack buffer, leading to arbitrary code execution under the context of the user.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: LabF
product: WinaXe FTP Client
default_status: unknown
Credits: lang: en
value: hyp3rlinx
Published: 2025-07-15T13:11:18.747Z
CVE-2025-34108 Disk Pulse Enterprise 9.0.34 Login Stack Buffer Overflow
A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Falconstor Software
product: Disk Pulse Enterprise
default_status: unknown
Credits: lang: en
value: Tulpa Security
Published: 2025-07-15T13:01:40.516Z
CVE-2025-34109 Panda Security PSEvents.exe Insecure DLL Loading Privilege Escalation
PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016 (all versions up to 16.1.2).
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Panda Security
product: Panda Global Protection 2016
default_status: unaffected
vendor: Panda Security
product: Panda Antivirus Pro 2016
default_status: unaffected
vendor: Panda Security
product: Panda Small Business Protection
default_status: unaffected
vendor: Panda Security
product: Panda Internet Security 2016
default_status: unaffected
Credits: lang: en
value: Security-Assessment.com
Published: 2025-07-15T13:04:59.958Z
CVE-2025-34110 ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure
A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files outside the configured FTP root directory. The flaw is due to insufficient sanitation of user-supplied file paths in the FTP GET and PUT command handlers. Exploitation is possible by submitting traversal sequences during FTP operations, enabling access to system-sensitive files. This issue affects only the Windows version of ColoradoFTP.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: ColoradoFTP
product: Server
default_status: unaffected
Credits: lang: en
value: RvLaboratory
Published: 2025-07-15T13:01:10.712Z
CVE-2025-34111 Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE
An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The vulnerable component does not enforce file type validation, allowing attackers to craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at /vendor_extra/elfinder/.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Tiki Software Community Association
product: Wiki CMS Groupware
default_status: unaffected
Credits: lang: en
value: Mehmet Ince
Published: 2025-07-15T13:09:56.350Z