rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-51733 
Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-28T00:00:00.000Z
CVE-2025-51734 
Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-28T00:00:00.000Z
CVE-2025-51735 
CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-28T00:00:00.000Z
CVE-2025-51736 
File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-28T00:00:00.000Z
CVE-2025-51741 
An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to send email verification messages to arbitrary users via the /sendEmailCodeForResetPwd endpoint potentially causing a denial of service to the server or the downstream users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-25T00:00:00.000Z
CVE-2025-51742 
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-25T00:00:00.000Z
CVE-2025-51743 
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-25T00:00:00.000Z
CVE-2025-51744 
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-25T00:00:00.000Z
CVE-2025-51745 
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-25T00:00:00.000Z
CVE-2025-51746 
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-25T00:00:00.000Z
CVE-2025-51818 
MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-21T00:00:00.000Z
CVE-2025-51823 
libcsp 2.0 is vulnerable to Buffer Overflow in the csp_eth_init() function due to improper handling of the ifname parameter. The function uses strcpy to copy the interface name into a structure member (ctx->name) without validating the input length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-11T00:00:00.000Z
CVE-2025-51824 
libcsp 2.0 is vulnerable to Buffer Overflow in the csp_usart_open() function at drivers/usart/zephyr.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-11T00:00:00.000Z
CVE-2025-51825 
JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSql endpoint, which allows bypassing SQL blacklist restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-51846 CryptPad unbounded WebSocket frame flood
CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: CryptPad
product: CryptPad
default_status: affected
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 7.5
attackVector: NETWORK
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: NONE
confidentialityImpact: NONE
Credits: lang: en
value: John Perifanis, Unisystems
Published: 2026-04-30T16:35:59.625Z
CVE-2025-51857 
The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-05T00:00:00.000Z
CVE-2025-51858 
Self Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbitrary code and gain sensitive information via a crafted SVG file contents sent through the chat component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-22T00:00:00.000Z
CVE-2025-51859 
Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the underlying Large Language Model (LLM) to embed malicious script payloads (e.g., SVG-based XSS) into its chat responses. When a user interacts with such a malicious agent or accesses a direct link to a conversation containing an XSS payload, the script executes in the user's browser. Successful exploitation can lead to the theft of sensitive information, such as JWT session tokens, potentially resulting in account hijacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-22T00:00:00.000Z
CVE-2025-51860 
Stored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by crafting an AI Character with SVG XSS payloads in either description, greeting, example dialog, or system prompt(instructing the LLM to embed XSS payload in its chat response). When a user interacts with such a malicious AI Character or just browse its profile, the script executes in the user's browser. Successful exploitation can lead to the theft of sensitive information, such as session tokens, potentially resulting in account hijacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-22T00:00:00.000Z
CVE-2025-51862 
Insecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and account hijacking via XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-22T00:00:00.000Z
CVE-2025-51863 
Self Cross Site Scripting (XSS) vulnerability in ChatGPT Unli (ChatGPTUnli.com) thru 2025-05-26 allows attackers to execute arbitrary code via a crafted SVG file to the chat interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-22T00:00:00.000Z
CVE-2025-51864 
A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-22T00:00:00.000Z
CVE-2025-51865 
Ai2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object Reference (IDOR), allowing attackers to gain sensitvie information via enumerating thread keys in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-22T00:00:00.000Z
CVE-2025-51867 
Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing attackers to chat with the LLM using other users' credits via sensitive information gained by the /browse/stories endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-22T00:00:00.000Z
CVE-2025-51868 
Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive information via the conversation_id parameter to the conversation_history endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-51869 
Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted space_id, thread_id, and message_id parameters to the v1/space/{space_id}/thread/{thread_id}/message/{message_id} endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-51951 
andisearch v0.5.249 was discovered to contain a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-30T00:00:00.000Z
CVE-2025-51954 
playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-30T00:00:00.000Z
CVE-2025-51958 
aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-30T00:00:00.000Z
CVE-2025-51962 
A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTML via the text parameter of add_project_comment function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-15T00:00:00.000Z
CVE-2025-51965 
OURPHP thru 8.6.1 is vulnerable to Cross-Site Scripting (XSS) via the "Name" field of the "Complete Profile" functionality under the "My User Center" page, which can be accessed after registering through the front-end interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-14T00:00:00.000Z
CVE-2025-51966 
A cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. When a user previews a specially crafted PDF file, embedded JavaScript code executes within the application's privileged context, potentially allowing attackers to steal sensitive data or perform unauthorized actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-02T00:00:00.000Z
CVE-2025-51967 
A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails to sanitize user-supplied input in the theme POST parameter, allowing an attacker to inject and execute arbitrary JavaScript in a victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-28T00:00:00.000Z
CVE-2025-51968 
A SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The application fails to properly sanitize user-supplied input in the proId POST parameter, allowing attackers to inject arbitrary SQL expressions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-28T00:00:00.000Z
CVE-2025-51969 
A SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0. This flaw is present in the product_id GET parameter, which is not properly validated before being included in a SQL statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-28T00:00:00.000Z
CVE-2025-51970 
A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2025-51971 
A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. Unsanitized user input in the f_name parameter is reflected in the server response without proper HTML encoding or output escaping. This allows remote attackers to inject arbitrary JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-28T00:00:00.000Z
CVE-2025-51972 
A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-28T00:00:00.000Z
CVE-2025-51986 
An issue was discovered in the demo/LINUXTCP implementation of cwalter-at freemodbus v.2018-09-12 allowing attackers to reach an infinite loop via a crafted length value for a packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-14T00:00:00.000Z
CVE-2025-51989 
HTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTML tags into the "keresztnév" (firstname) field, which will be sent out in an email resulting in possible Phishing scenarios against any, previously not registered, email address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-21T00:00:00.000Z
CVE-2025-51990 
XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the Presentation section of the Global Preferences panel. An authenticated administrator can inject arbitrary JavaScript payloads into the HTTP Meta Info, Footer Copyright, and Footer Version fields. These inputs are stored and subsequently rendered without proper output encoding or sanitization on public-facing pages. As a result, the injected scripts are persistently executed in the browser context of any visitor to the affected instances including both authenticated and unauthenticated users. No user interaction is required beyond visiting a page that includes the malicious content. Successful exploitation can lead to session hijacking, credential theft, unauthorized actions via session riding, or further compromise of the application through client-side attacks. The vulnerability introduces significant risk in any deployment, especially in shared or internet-facing environments where administrator credentials may be compromised.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-20T00:00:00.000Z
CVE-2025-51991 
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is rendered on the server side without proper validation or sandboxing. This enables the execution of arbitrary template logic, which may expose internal server information or, in specific configurations, lead to further exploitation such as remote code execution or sensitive data leakage. The vulnerability resides in improper handling of dynamic template rendering within user-supplied configuration fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-20T00:00:00.000Z
CVE-2025-52021 
A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The product_id GET parameter is unsafely passed to a SQL query without proper validation or parameterization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-07T00:00:00.000Z
CVE-2025-52022 
A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public API endpoints, exposing potentially sensitive information useful for further exploitation. This issue is classified under CWE-209: Information Exposure Through an Error Message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-52023 
A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public API endpoints, exposing potentially sensitive information useful for further exploitation. This issue is classified under CWE-209: Information Exposure Through an Error Message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-52024 
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, each with an HTML form for submitting test input. These panels are intended for developer use, but are accessible in production environments with no authentication or session validation. This grants any external actor the ability to discover, test, and execute API endpoints that perform critical functions including but not limited to user transaction retrieval, credit adjustments, POS actions, and internal data queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-52025 
An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without proper sanitization or parameterization. This allows an attacker to inject and execute arbitrary SQL code by submitting crafted input in the id parameter, leading to unauthorized data access or modification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-52026 
An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint returns a list of cashier accounts, including names, email addresses, usernames, and passwords hashed using MD5. As MD5 is a broken cryptographic function, the hashes can be easily reversed using public tools, exposing user credentials in plaintext. This allows remote attackers to perform unauthorized logins and potentially gain access to sensitive POS operations or backend functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-52035 
A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08) and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-52036 
A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08), and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability: CWE-79.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-52037 
A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08), and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability: CWE-79.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-52039 
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-01T00:00:00.000Z
CVE-2025-52040 
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanket_order_type parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-01T00:00:00.000Z
CVE-2025-52041 
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventory_dimensions_dict parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-01T00:00:00.000Z
CVE-2025-52042 
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-01T00:00:00.000Z
CVE-2025-52043 
In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-30T00:00:00.000Z