rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-66880 
Cross Site Scripting vulnerability in Wethink Technology Inc 720yun pano-sdk 0.5.877 allows a remote attacker to execute arbitrary code via the LoginComp (Module 2093) and SignupComp (Module 2094) modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2025-66902 
An input validation issue in in Pithikos websocket-server v.0.6.4 allows a remote attacker to obtain sensitive information or cause unexpected server behavior via the websocket_server/websocket_server.py, WebSocketServer._message_received components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-20T00:00:00.000Z
CVE-2025-66905 
The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-19T00:00:00.000Z
CVE-2025-66906 
Cross Site Request Forgery (CSRF) vulnerability in Turms Admin API thru v0.10.0-SNAPSHOT allows attackers to gain escalated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-19T00:00:00.000Z
CVE-2025-66908 
Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrController in turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java uses the @FormData(contentType = MediaTypeConst.IMAGE) annotation to restrict uploads to image files, but this constraint is not properly enforced. The system relies solely on client-provided Content-Type headers and file extensions without validating actual file content using magic bytes (file signatures). An attacker can upload arbitrary file types including executables, scripts, HTML, or web shells by setting the Content-Type header to "image/*" or using an image file extension. This bypass enables potential server-side code execution, stored XSS, or information disclosure depending on how uploaded files are processed and served.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-19T00:00:00.000Z
CVE-2025-66909 
Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCVImage class in ai/djl/opencv/ExtendedOpenCVImage.java loads images using OpenCV's imread() function without validating dimensions or pixel count before decompression. An attacker can upload a specially crafted compressed image file (e.g., PNG) that is small when compressed but expands to gigabytes of memory when loaded. This causes immediate memory exhaustion, OutOfMemoryError, and service crash. No authentication is required if the OCR service is publicly accessible. Multiple requests can completely deny service availability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-19T00:00:00.000Z
CVE-2025-66910 
Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login, raw passwords are stored unencrypted in memory in the rawPassword field. Attackers with local system access can extract these passwords through memory dumps, heap analysis, or debugger attachment, bypassing bcrypt protection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-19T00:00:00.000Z
CVE-2025-66911 
Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-19T00:00:00.000Z
CVE-2025-66913 
JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than CVE-2025-10770.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-08T00:00:00.000Z
CVE-2025-66916 
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-08T00:00:00.000Z
CVE-2025-66918 
edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-11T00:00:00.000Z
CVE-2025-66921 
A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-66923 
A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-66924 
A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-66939 
Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-12T00:00:00.000Z
CVE-2025-66944 
SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query parameter in the search API endpoint
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2025-66945 
A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-03T00:00:00.000Z
CVE-2025-66947 
SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-26T00:00:00.000Z
CVE-2025-66953 
CSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker to execute arbitrary code via the Web-based management interface and specifically the /system_setup.htm, /set_clock.htm, /receiver_setup.htm, /cal.htm?..., and /channel_setup.htm endpoints
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-66954 
A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles. The issue is triggered by modifying a parameter within requests sent to the /nasapi endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-20T00:00:00.000Z
CVE-2025-66955 
Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via "path" parameter in the downloadAttachment and downloadAttachmentFromPath API calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2025-66956 
Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-11T00:00:00.000Z
CVE-2025-66959 
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-21T00:00:00.000Z
CVE-2025-66960 
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF metadata
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-21T00:00:00.000Z
CVE-2025-66963 
An issue in Hitron HI3120 v.7.2.4.5.2b1 allows a local attacker to obtain sensitive information via the Logout option in the index.html
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-15T00:00:00.000Z
CVE-2025-67004 
** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back. It can Disclosure the source code or any other confidential information if weaponize accordingly. NOTE: A community member states that this is not a CouchCMS vulnerability and that if /\<file> is accessible it is a web-server configuration issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-09T00:00:00.000Z
CVE-2025-67013 
The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-26T00:00:00.000Z
CVE-2025-67014 
Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an administrative endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-26T00:00:00.000Z
CVE-2025-67015 
Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/admin_access_1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-26T00:00:00.000Z
CVE-2025-67025 
Cross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code via the Anycomment comment section
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-67030 
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-25T00:00:00.000Z
CVE-2025-67031 
ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem. Certain field configurations accept values beginning with the prefix "func:" which are passed directly into an eval() call inside tagsets/participant.php and tagsets/options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-15T00:00:00.000Z
CVE-2025-67034 
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-11T00:00:00.000Z
CVE-2025-67035 
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-11T00:00:00.000Z
CVE-2025-67036 
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-11T00:00:00.000Z
CVE-2025-67037 
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-11T00:00:00.000Z
CVE-2025-67038 
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-11T00:00:00.000Z
CVE-2025-67039 
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-11T00:00:00.000Z
CVE-2025-67041 
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-11T00:00:00.000Z
CVE-2025-67070 
A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the multi-factor authentication (MFA) mechanism during the password recovery process. This results in the ability to change the admin password and gain full access to the administrative panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-09T00:00:00.000Z
CVE-2025-67073 
A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`) to /goform/AdvSetMacMtuWan.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67074 
A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serverName`) to /goform/AdvSetMacMtuWan.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67076 
Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via the misc controller and the ExternalGetFile action. Only files with an extension can be read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-67077 
File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-67078 
Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notify parameter of the file controller used to display errors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-67079 
File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-67081 
An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing on integer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-67082 
An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing of single quotes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-67083 
Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-67084 
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-67089 
A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-08T00:00:00.000Z
CVE-2025-67090 
The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 & 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-08T00:00:00.000Z
CVE-2025-67091 
An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg-call. The script is executed with root privileges when triggered via the LuCI web interface or authenticated API calls to manage packages. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-08T00:00:00.000Z
CVE-2025-67102 
A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-17T00:00:00.000Z
CVE-2025-67108 
eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-23T00:00:00.000Z
CVE-2025-67109 
Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-23T00:00:00.000Z
CVE-2025-67111 
An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-23T00:00:00.000Z
CVE-2025-67112 
Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote authenticated users to decrypt, modify, and re-encrypt device configurations, enabling credential manipulation and privilege escalation via the GUI import/export functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-19T00:00:00.000Z
CVE-2025-67113 
OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into the firmware upgrade pipeline.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-19T00:00:00.000Z
CVE-2025-67114 
Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers to derive valid administrative/root credentials from the device's MAC address, enabling authentication bypass and full device access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-19T00:00:00.000Z