rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-40682 SQL injection vulnerability in Human Resource Management System
SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Human Resource Management System
product: Human Resource Management System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-07-29T12:10:56.140Z
CVE-2025-40683 Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management System
Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searccity' parameter in /city.php.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Human Resource Management System
product: Human Resource Management System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-07-29T12:12:23.418Z
CVE-2025-40684 Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management System
Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searccountry' parameter in/country.php.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Human Resource Management System
product: Human Resource Management System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-07-29T12:12:34.325Z
CVE-2025-40685 Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management System
Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searcstate' parameter in/state.php.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Human Resource Management System
product: Human Resource Management System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-07-29T12:12:44.243Z
CVE-2025-40686 Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management System
Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'employeeid' parameter in/detailview.php.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Human Resource Management System
product: Human Resource Management System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-07-29T12:12:58.888Z
CVE-2025-40687 SQL injection in PHPGurukul Online Fire Reporting System
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 

'mobilenumber', 'teamleadname' and 'teammember' parameters in the endpoint '/ofrs/admin/add-team.php'.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: PHPGurukul
product: Online Fire Reporting System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-11T11:15:30.359Z
CVE-2025-40689 SQL injection in PHPGurukul Online Fire Reporting System
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 

'remark', 'status' and 'requestid' parameters in the endpoint '/ofrs/admin/request-details.php'.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: PHPGurukul
product: Online Fire Reporting System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-11T11:21:04.508Z
CVE-2025-40690 SQL injection in PHPGurukul Online Fire Reporting System
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: PHPGurukul
product: Online Fire Reporting System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-11T11:23:32.365Z
CVE-2025-40691 SQL injection in PHPGurukul Online Fire Reporting System
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 

'todate' parameter in the endpoint '/ofrs/admin/bwdates-report-result.php'.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: PHPGurukul
product: Online Fire Reporting System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-11T11:25:36.321Z
CVE-2025-40692 SQL injection in PHPGurukul Online Fire Reporting System
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 

'requestid' parameter in the endpoint '/ofrs/details.php'.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: PHPGurukul
product: Online Fire Reporting System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-11T11:27:28.569Z
CVE-2025-40693 Cross Site Scripting in PHPGurukul Online Fire Reporting System
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of propper validation of user inputs 'tname' parameter via GET and, 'teamleadname', 'teammember' and 'teamname'

 parameters via POST at the endpoint '/ofrs/admin/edit-team.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: PHPGurukul
product: Online Fire Reporting System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-11T11:36:38.826Z
CVE-2025-40694 Cross Site Scripting in PHPGurukul Online Fire Reporting System
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fromdate' and 'todate' parameters via POST at the endpoint '/ofrs/admin/bwdates-report-result.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: PHPGurukul
product: Online Fire Reporting System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-11T11:40:56.019Z
CVE-2025-40695 Cross Site Scripting in PHPGurukul Online Fire Reporting System
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'remark', 'status' and 'takeaction' parameters via POST at the endpoint '/ofrs/admin/request-details.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: PHPGurukul
product: Online Fire Reporting System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-11T11:46:39.872Z
CVE-2025-40696 Cross Site Scripting in PHPGurukul Online Fire Reporting System
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fullname', 'location' and 'message' parameters via POST at the endpoint '/ofrs/reporting.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: PHPGurukul
product: Online Fire Reporting System
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2025-09-11T11:49:52.609Z
CVE-2025-40697 Reflected Cross-Site Scripting (XSS) in Lewe WebMeasure
Reflected Cross-Site Scripting (XSS) vulnerability in '/index.php' in Lewe WebMeasure, which allows remote attackers to execute arbitrary code through the 'page' parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Lewe
product: WebMeasure
default_status: affected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-02-19T08:44:16.386Z
CVE-2025-40698 SQL injection vulnerability in Prevengos
SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in “/servicios/autorizaciones.asmx/mfsRecuperarListado”.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Nedatec Consulting
product: Prevengos
default_status: unaffected
Credits: lang: en
value: Pedro Gabaldón Juliá
lang: en
value: Javier Medina Munuera
lang: en
value: Antonio José Gálvez Sánchez
lang: en
value: Alejandro Baño Andrés
lang: en
value: Álvaro Piñero Laorden
Published: 2025-09-25T11:15:38.873Z
CVE-2025-40700 Reflected Cross-Site Scripting (XSS) in Governalia by IDI Eikon
Reflected Cross-Site Scripting (XSS) in IDI Eikon's Governalia. The vulnerability allows an attacker to execute JavaScript code in the victim's browser when a malicious URL with the 'q' parameter in '/search' is sent to them. This vulnerability can be exploited to steal sensitive information such as session cookies or to perform actions on behalf of the victim.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: IDI Eikon
product: Governalia
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2025-12-02T13:08:55.540Z
CVE-2025-40701 Reflected Cross-Site scripting (XSS) in SOTE's SOTESHOP
Reflected Cross-Site Scripting vulnerability in SOTESHOP, version 8.3.4. THis vulnerability allows an attacker execute JavaScript code in the victim's browser when a malicious URL with the 'id' parameter in '/adsTracker/checkAds' is sent to the victim. The vulnerability can be exploited to steal sensitive user information such as session cookies, or to perform actions on their behalf.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: SOTE
product: SOTESHOP
default_status: unaffected
Credits: lang: en
value: Gonzalo Aguilar García (6h4ack)
Published: 2026-02-23T10:23:51.497Z
CVE-2025-40702 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/file" petition, "creator" and "license_holder" parameters.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ACDH-CH
product: OpenAtlas
default_status: unaffected
Credits: lang: en
value: Andrea Intilangelo (acme)
Published: 2025-08-29T11:16:32.480Z
CVE-2025-40703 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/group" petition, "name" and "alias-0” parameters.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ACDH-CH
product: OpenAtlas
default_status: unaffected
Credits: lang: en
value: Andrea Intilangelo (acme)
Published: 2025-08-29T11:16:53.723Z
CVE-2025-40704 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/edition" petition, "name" parameter.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ACDH-CH
product: OpenAtlas
default_status: unaffected
Credits: lang: en
value: Andrea Intilangelo (acme)
Published: 2025-08-29T11:17:06.661Z
CVE-2025-40705 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/acquisition" petition, "name" parameter.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ACDH-CH
product: OpenAtlas
default_status: unaffected
Credits: lang: en
value: Andrea Intilangelo (acme)
Published: 2025-08-29T11:17:17.539Z
CVE-2025-40706 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/source" petition, "name" parameter.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ACDH-CH
product: OpenAtlas
default_status: unaffected
Credits: lang: en
value: Andrea Intilangelo (acme)
Published: 2025-08-29T11:17:27.929Z
CVE-2025-40707 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/place" petition, "name" and "alias-0” parameters.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ACDH-CH
product: OpenAtlas
default_status: unaffected
Credits: lang: en
value: Andrea Intilangelo (acme)
Published: 2025-08-29T11:17:41.267Z
CVE-2025-40708 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/event" petition, "name" parameter.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ACDH-CH
product: OpenAtlas
default_status: unaffected
Credits: lang: en
value: Andrea Intilangelo (acme)
Published: 2025-08-29T11:18:03.432Z
CVE-2025-40709 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH
Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/person/<ID>” petition, "name" and "alias-0” parameters.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ACDH-CH
product: OpenAtlas
default_status: unaffected
Credits: lang: en
value: Andrea Intilangelo (acme)
Published: 2025-08-29T11:18:17.870Z
CVE-2025-40710 Host Header Injection (HHI) in the Hotspot Shield VPN client
Host Header Injection (HHI) vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications through the VPN tunnel. Although such applications do not present this vulnerability per se, the use of the tunnel, together with a forged Host header, can cause the VPN client to redirect or forward HTTP requests to servers other than those originally intended, leading to consequences such as open redirects or delivery of traffic to infrastructure controlled by an attacker. This does not imply a flaw in the target applications, but in how the VPN client internally handles outgoing headers and requests.
Problem types: cwe_id: CWE-74
description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Hotspot Shield
product: Hotspot Shield VPN client
default_status: unaffected
Published: 2025-06-30T10:37:05.241Z
CVE-2025-40711 SQL injection vulnerability in Quiter Gateway
SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the id_concesion parameter in /<Client>FacturaE/VerFacturaPDF.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quiter
product: Quiter Gateway (Java WAR on Apache Tomcat)
default_status: unaffected
Credits: lang: en
value: David Carrión Poza
Published: 2025-07-08T11:33:15.989Z
CVE-2025-40712 SQL injection vulnerability in Quiter Gateway
SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the id_concesion parameter in /<Client>FacturaE/DescargarFactura.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quiter
product: Quiter Gateway (Java WAR on Apache Tomcat)
default_status: unaffected
Credits: lang: en
value: David Carrión Poza
Published: 2025-07-08T11:33:40.855Z
CVE-2025-40713 SQL injection vulnerability in Quiter Gateway
SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the campo parameter in/<Client>FacturaE/BusquedasFacturasSesion.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quiter
product: Quiter Gateway (Java WAR on Apache Tomcat)
default_status: unaffected
Credits: lang: en
value: David Carrión Poza
Published: 2025-07-08T11:35:31.949Z
CVE-2025-40714 SQL injection vulnerability in Quiter Gateway
SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the campo id_factura in /<Client>FacturaE/listado_facturas_ficha.jsp.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quiter
product: Quiter Gateway (Java WAR on Apache Tomcat)
default_status: unaffected
Credits: lang: en
value: David Carrión Poza
Published: 2025-07-08T11:35:53.981Z
CVE-2025-40715 SQL injection vulnerability in Quiter Gateway
SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the campo mensaje in /QISClient/api/v1/sucesospaginas.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quiter
product: Quiter Gateway (Java WAR on Apache Tomcat)
default_status: unaffected
Credits: lang: en
value: David Carrión Poza
Published: 2025-07-08T11:36:14.555Z
CVE-2025-40716 SQL injection vulnerability in Quiter Gateway
SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the suceso.contenido mensaje in /QMSCliente/Sucesos.action.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quiter
product: Quiter Gateway (Java WAR on Apache Tomcat)
default_status: unaffected
Credits: lang: en
value: David Carrión Poza
Published: 2025-07-08T11:36:53.133Z