rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-59052 Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes.
The issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false.
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: angular
product: angular
Published: 2025-09-10T20:13:56.965Z
CVE-2025-59053 AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE
AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the `packages/stage-ui/src/components/MarkdownRenderer.vue` path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An attacker creates a card file containing malicious HTML/JavaScript, then simply processes it using the highlightTagToHtml function (which simply replaces template tags without HTML escaping), and then directly renders it using v-html, leading to cross-site scripting (XSS). The project also exposes the Tauri API, which can be called from the frontend. The MCP plugin exposes a command execution interface function in `crates/tauri-plugin-mcp/src/lib.rs`. This allows arbitrary command execution. `connect_server` directly passes the user-supplied `command` and `args` parameters to `Command::new(command).args(args)` without any input validation or whitelisting. Thus, the previous XSS exploit could achieve command execution through this interface. v0.7.2-beta.3 fixes the issue.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: moeru-ai
product: airi
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.7
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-09-11T18:26:52.485Z
CVE-2025-59054 dstack has insecure LUKS2 persistent storage partitions that may be opened and used
dstack is a software development kit (SDK) to simplify the deployment of arbitrary containerized apps into trusted execution environments. In versions of dstack prior to 0.5.4, a malicious host may provide a crafted LUKS2 data volume to a dstack CVM for use as the `/data` mount. The guest will open the volume and write secret data using a volume key known to the attacker, causing disclosure of Wireguard keys and other secret information. The attacker can also pre-load data on the device, which could potentially compromise guest execution. LUKS2 volume metadata is not authenticated and supports null key-encryption algorithms, allowing an attacker to create a volume such that the volume opens (cryptsetup open) without error using any passphrase or token, records all writes in plaintext (or ciphertext with an attacker-known key), and/or contains arbitrary data chosen by the attacker. Version 0.5.4 of dstack contains a patch that addresses LUKS headers.
Problem types: cwe_id: CWE-552
description: CWE-552: Files or Directories Accessible to External Parties
Affected products: vendor: Dstack-TEE
product: dstack
Published: 2025-09-12T13:01:02.816Z
CVE-2025-59055 InstantCMS vulnerable to Server-Side Request Forgery via package installer
InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It is possible to make any HTTP/HTTPS request to any website in installer functionality. Due to such vulnerability it is possible to for example scan local network, call local services and its functions, conduct a DoS attack, and/or disclose a server's real IP if it's behind a reverse proxy. It is also possible to exhaust server resources by sending plethora of such requests. As of time of publication, no patched releases are available.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: instantsoft
product: icms2
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-09-11T18:46:29.139Z
CVE-2025-59056 FreePBX vulnerable to unauthenticated Denial of Service
FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: FreePBX
product: framework
Published: 2025-09-15T21:04:07.875Z
CVE-2025-59057 React Router has XSS Vulnerability
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: remix-run
product: react-router
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
version: 3.1
Published: 2026-01-10T02:40:25.142Z
CVE-2025-59058 httpsig-rs's HMAC verification is vulnerable to timing attack
httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version 0.0.19 fixes the issue.
Problem types: cwe_id: CWE-208
description: CWE-208: Observable Timing Discrepancy
Affected products: vendor: junkurihara
product: httpsig-rs
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2025-09-12T13:10:11.349Z
CVE-2025-59059 Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Ranger
default_status: unaffected
Credits: lang: en
value: chengtianyi <chengtianyi@huawei.com>
Published: 2026-03-03T10:44:47.294Z
CVE-2025-59060 Apache Ranger: Hostname verification bypass in NiFiRegistryClient and NifiClient
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions <= 2.7.0.

Users are recommended to upgrade to version 2.8.0, which fixes this issue.
Problem types: cwe_id: CWE-297
description: CWE-297 Improper Validation of Certificate with Host Mismatch
Affected products: vendor: Apache Software Foundation
product: Apache Ranger
default_status: unaffected
Credits: lang: en
value: Nikita Markevich <markevich.nikita1@gmail.com>
Published: 2026-03-03T10:46:52.382Z
CVE-2025-59090 Unauthenticated SOAP API in dormakaba Kaba exos 9300
On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
cwe_id: CWE-1188
description: CWE-1188: Initialization of a Resource with an Insecure Default
Affected products: vendor: dormakaba
product: Kaba exos 9300
default_status: unknown
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:03:21.868Z
CVE-2025-59091 Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300
Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically visualize open doors and alerts. However, controlling the Access Managers via this interface is also possible.

To send and receive status information, authentication is necessary. The Kaba exos 9300 application contains hard-coded credentials for four different users, which are allowed to login to the datapoint server and receive as well as send information, including commands to open arbitrary doors.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: dormakaba
product: Kaba exos 9300
default_status: unknown
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:03:34.142Z
CVE-2025-59092 Unauthenticated RPC Service in dormakaba Kaba exos 9300
An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used for interprocess communication between services and the Kaba exos 9300 GUI, containing status information about the Access Managers. Interacting with the service does not require any authentication. Therefore, it is possible to send arbitrary status information about door contacts etc. without prior authentication.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: dormakaba
product: Kaba exos 9300
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:03:44.324Z
CVE-2025-59093 Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 9300
Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from the registry. This allows an attacker to derive the database password and get authenticated access to the central exos 9300 database as the user Exos9300Common. The user has the roles ExosDialog and ExosDialogDotNet assigned, which are able to read most tables of the database as well as update and insert into many tables.
Problem types: cwe_id: CWE-656
description: CWE-656: Reliance on Security Through Obscurity
Affected products: vendor: dormakaba
product: Kaba exos 9300
default_status: affected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:03:54.991Z
CVE-2025-59094 Local Privilege Escalation in dormakaba Kaba exos 9300 System management
A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specified executable should be run with SYSTEM privileges.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: dormakaba
product: Kaba exos 9300
default_status: affected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:04:05.551Z
CVE-2025-59095 Hard-coded Key for PIN Encryption in dormakaba Kaba exos 9300
The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption technique combined with a cryptographic key (cryptoKey) to transform each character of the input string. However, it's important to note that this implementation does not provide strong encryption and should not be considered secure for sensitive data. It's more of a custom encryption approach rather than a common algorithm used in cryptographic applications. The key itself is static and based on the founder's name of the company. The functionality is for example used to encrypt the user PINs before storing them in the MSSQL database.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: dormakaba
product: Kaba exos 9300
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:04:15.107Z
CVE-2025-59096 Weak Default Password in dormakaba Kaba exos 9300
The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as well as documented in the locally stored user documentation.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: dormakaba
product: Kaba exos 9300
default_status: affected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:04:24.548Z
CVE-2025-59097 Unauthenticated SOAP API in dormakaba access manager
The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is sent to the selected Access Manager via SOAP. The SOAP request is sent without any prior authentication or authorization by default. Though authentication and authorization can be configured using IPsec for 92xx-K5 devices and mTLS for 92xx-K7 devices, it is not enabled by default and must therefore be activated with additional steps.

This insecure default allows an attacker with network level access to completely control the whole environment. An attacker is for example easily able to conduct the following tasks without prior authentication:
- Re-configure Access Managers (e.g. remove alarming system requirements)
- Freely re-configure the inputs and outputs
- Open all connected doors permanently
- Open all doors for a defined time interval
- Change the admin password
- and many more

Network level access can be gained due to an insufficient network segmentation as well as missing LAN firewalls. Devices with an insecure configuration have been identified to be directly exposed to the internet.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
cwe_id: CWE-1188
description: CWE-1188: Initialization of a Resource with an Insecure Default
Affected products: vendor: dormakaba
product: Access Manager 92xx-k5
default_status: affected
vendor: dormakaba
product: Access Manager 92xx-k7
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:04:38.742Z
CVE-2025-59098 Trace Functionality Leaking Sensitive Data in dormakaba access manager
The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the socket and receive debug information. The data is permanently broadcasted on the TCP socket. The socket can be accessed without any authentication or encryption. 

The transmitted data is based on the set verbosity level. The verbosity level can be set using the http(s) endpoint with the service interface password or with the guessable identifier of the device via the SOAP interface.

The transmitted data contains sensitive data like the Card ID as well as all button presses on Registration units. This allows an attacker with network level access to retrieve all entered PINs on a registration unit.
Problem types: cwe_id: CWE-497
description: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: dormakaba
product: Access Manager 92xx-k5
default_status: unaffected
vendor: dormakaba
product: Access Manager 92xx-k7
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:04:51.022Z
CVE-2025-59099 Unauthenticated Path Traversal in dormakaba access manager
The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. 

Hence, it is possible to retrieve all files stored on the file system, including the SQLite database Database.sq3, containing badge information and the corresponding PIN codes. Additionally, when trying to access certain files, the web server crashes and becomes unreachable for about 60 seconds. This can be abused to continuously send the request and cause denial of service.
Problem types: cwe_id: CWE-35
description: CWE-35: Path Traversal
Affected products: vendor: dormakaba
product: Access Manager 92xx-k5
default_status: unaffected
vendor: dormakaba
product: Access Manager 92xx-k7
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:05:02.663Z
CVE-2025-59100 Unauthenticated Access to the SQLite Database in dormakaba access manager
The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download is started and the device reboots. After rebooting, the exported database is deleted and cannot be accessed anymore. However, it was noticed that sometimes the device does not reboot and therefore the exported database is not deleted, or the device reboots and the export is not deleted for unknown reasons. The path where the database export is located can be accessed without prior authentication. This leads to the fact that an attacker might be able to get access to the exported database without prior authentication. 
The database includes sensitive data like passwords, card pins, encrypted Mifare sitekeys and much more.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: dormakaba
product: Access Manager 92xx-k5
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:05:11.306Z
CVE-2025-59101 Insufficient Session Management in dormakaba access manager
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface.
Problem types: cwe_id: CWE-291
description: CWE-291: Reliance on IP Address for Authentication
Affected products: vendor: dormakaba
product: Access Manager 92xx-k5
default_status: unaffected
vendor: dormakaba
product: Access Manager 92xx-k7
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:05:20.665Z
CVE-2025-59102 Secrets Stored in Plaintext in Database in dormakaba access manager
The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The PINs are even stored unencrypted. Combined with the fact that an attacker can easily get access to the backup functionality by abusing the session management issue (CVE-2025-59101), or by exploiting the weak default password (CVE-2025-59108), or by simply setting a new password without prior authentication via the SOAP API (CVE-2025-59097), it is easily possible to access the sensitive data on the device.
Problem types: cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
Affected products: vendor: dormakaba
product: Access Manager 92xx-k5
default_status: unaffected
Credits: lang: en
value: Clemens Stockenreitner, SEC Consult Vulnerability Lab
lang: en
value: Werner Schober, SEC Consult Vulnerability Lab
Published: 2026-01-26T10:05:31.292Z