rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-66214 Ladybug has an XMLDecoder Deserialization Vulnerability (Java RCE)
Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these XML files, enabling attackers to achieve Remote Code Execution (RCE) by submitting carefully crafted XML payloads and thereby gain access to the target server. This issue is fixed in version 3.0-20251107.114628.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: wearefrank
product: ladybug
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
version: 3.1
Published: 2025-12-09T19:37:18.664Z
CVE-2025-66215 OpenSC: Stack-buffer-overflow WRITE in card-oberthur
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: OpenSC
product: OpenSC
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2026-03-30T17:06:16.996Z
CVE-2025-66216 AIS-catcher has a Buffer Overflow vulnerability in `AIS::Message` leading to DoS/RCE
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-catcher. This vulnerability allows an attacker to write approximately 1KB of arbitrary data into a 128-byte buffer. This issue has been patched in version 0.64.
Problem types: cwe_id: CWE-131
description: CWE-131: Incorrect Calculation of Buffer Size
Affected products: vendor: jvde-github
product: AIS-catcher
Published: 2025-11-29T01:57:55.350Z
CVE-2025-66217 AIS-catcher Integer Underflow in MQTT Packet Parsing leading to Heap Buffer Overflow
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This vulnerability allows an attacker to trigger a massive Heap Buffer Overflow by sending a malformed MQTT packet with a manipulated Topic Length field. This leads to an immediate Denial of Service (DoS) and, when used as a library, severe Memory Corruption that can be leveraged for Remote Code Execution (RCE). This issue has been patched in version 0.64.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
cwe_id: CWE-191
description: CWE-191: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: jvde-github
product: AIS-catcher
Published: 2025-11-29T01:57:52.613Z
CVE-2025-66219 willitmerge has a command Injection vulnerability
willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: shama
product: willitmerge
Published: 2025-11-29T01:34:33.487Z
CVE-2025-66220 Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.
Problem types: cwe_id: CWE-170
description: CWE-170: Improper Null Termination
Affected products: vendor: envoyproxy
product: envoy
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2025-12-03T18:31:50.389Z
CVE-2025-66221 Werkzeug safe_join() allows Windows special device names
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.
Problem types: cwe_id: CWE-67
description: CWE-67: Improper Handling of Windows Device Names
Affected products: vendor: pallets
product: werkzeug
Published: 2025-11-29T02:28:34.524Z
CVE-2025-66222 DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)
DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC bridge, this XSS can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP (Model Context Protocol) server.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: ThinkInAIXYZ
product: deepchat
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.7
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-12-03T18:34:44.019Z
CVE-2025-66223 OpenObserve's Invite Token Lifecycle Misconfiguration
OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issued links remain valid simultaneously. This results in broken access control where a removed or demoted user can regain access or escalate privileges. This issue has been patched in version 0.16.0.
Problem types: cwe_id: CWE-613
description: CWE-613: Insufficient Session Expiration
cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: openobserve
product: openobserve
Published: 2025-11-29T02:45:42.467Z
CVE-2025-66224 OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail configuration and delivery workflow that allows user-controlled values to flow directly into the system’s sendmail command. Because these values are not sanitized or constrained before being incorporated into the command execution path, certain sendmail behaviors can be unintentionally invoked during email processing. This makes it possible for the application to write files on the server as part of the mail-handling routine, and in deployments where those files end up in web-accessible locations, the behavior can be leveraged to achieve execution of attacker-controlled content. The issue stems entirely from constructing OS-level command strings using unsanitized input within the mail-sending logic. This issue has been patched in version 5.8.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: orangehrm
product: orangehrm
Published: 2025-11-29T03:04:42.301Z
CVE-2025-66225 OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally initiated. After obtaining a valid reset link for any account they can receive email for, an attacker can alter the username parameter in the final reset request to target a different user. Because the system accepts the supplied username without verification, the attacker can set a new password for any chosen account, including privileged accounts, resulting in full account takeover. This issue has been patched in version 5.8.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: orangehrm
product: orangehrm
Published: 2025-11-29T03:05:46.498Z
CVE-2025-66236 Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though Airflow's intentions and security model of Airflow did not suggest different assumptions. The overall security model [1], workload isolation [2], and JWT authentication details [3] are now described in more detail. Users concerned with role isolation and following the Airflow security model of Airflow are advised to upgrade to Airflow 3.2, where several security improvements have been implemented. They should also read and follow the relevant documents to make sure that their deployment is secure enough. It also clarifies that the Deployment Manager is ultimately responsible for securing your Airflow deployment. This had also been communicated via Airflow 3.2.0 Blog announcement [4].

[1] Security Model:  https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html 
[2] Workload isolation:  https://airflow.apache.org/docs/apache-airflow/stable/security/workload.html 
[3] JWT Token authentication:  https://airflow.apache.org/docs/apache-airflow/stable/security/jwt_token_authentication.html 
[4] Airflow 3.2.0 Blog announcement:  https://airflow.apache.org/blog/airflow-3.2.0/ 



Users are recommended to upgrade to version 3.2.0, which fixes this issue.
Problem types: cwe_id: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
default_status: unaffected
Credits: lang: en
value: Saurabh Banawar
lang: en
value: Amogh Desai
Published: 2026-04-13T14:20:37.180Z
CVE-2025-66237 Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials
DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Sunbird
product: DCIM dcTrack
default_status: unaffected
vendor: Sunbird
product: Power IQ
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: notnotnotveg (notnotnotveg@gmail.com) reported these vulnerabilities to CISA.
Published: 2025-12-04T21:02:59.614Z
CVE-2025-66238 Sunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel
DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual console could exploit these features to redirect network traffic, potentially accessing restricted services or data on the host machine.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Sunbird
product: DCIM dcTrack
default_status: unaffected
vendor: Sunbird
product: IQ
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: notnotnotveg (notnotnotveg@gmail.com) reported these vulnerabilities to CISA.
Published: 2025-12-04T21:10:11.206Z
CVE-2025-66249 Apache Livy: Unauthorized directory access
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy.

This issue affects Apache Livy: from 0.3.0 before 0.9.0.

The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value "livy.file.local-dir-whitelist" is set to a non-default value, the directory checking can be bypassed.

Users are recommended to upgrade to version 0.9.0, which fixes the issue.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Apache Software Foundation
product: Apache Livy
default_status: unaffected
Credits: lang: en
value: Hiroki Egawa
Published: 2026-03-13T15:21:53.722Z
CVE-2025-66250 Unauthenticated Arbitrary File Upload (status_contents.php)
Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.
Problem types: cwe_id: CWE-434
description: CWE-434 Unauthenticated Arbitrary File Upload (status_contents.php)
Affected products: vendor: DB Electronica Telecomunicazioni S.p.A.
product: Mozart FM Transmitter
default_status: unaffected
Credits: lang: en
value: Abdul Mhanni
Published: 2025-11-26T00:29:57.431Z
CVE-2025-66251 Unauthenticated Path Traversal with Arbitrary File Deletion
Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletehidden parameter allows path traversal deletion of arbitrary .tgz files.
Problem types: cwe_id: CWE-22
description: CWE-22 Unauthenticated Path Traversal with Arbitrary File Deletion
Affected products: vendor: DB Electronica Telecomunicazioni S.p.A.
product: Mozart FM Transmitter
default_status: unaffected
Credits: lang: en
value: Abdul Mhanni
Published: 2025-11-26T00:32:26.142Z
CVE-2025-66252 Infinite Loop Denial of Service via Failed File Deletion
Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Infinite loop when unlink() fails in status_contents.php causing DoS. Due to the fact that the unlink operation is done in a while loop; if an immutable file is specified or otherwise a file in which the process has no permissions to delete; it would repeatedly attempt to do in a loop.
Problem types: cwe_id: CWE-835
description: CWE-835 Infinite Loop Denial of Service via Failed File Deletion
Affected products: vendor: DB Electronica Telecomunicazioni S.p.A.
product: Mozart FM Transmitter
default_status: unaffected
Credits: lang: en
value: Abdul Mhanni
Published: 2025-11-26T00:34:11.994Z
CVE-2025-66253 Unauthenticated OS Command Injection (start_upgrade.php)
Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec() allows remote code execution via start_upgrade.php. The `/var/tdf/start_upgrade.php` endpoint passes user-controlled `$_GET["filename"]` directly into `exec()` without sanitization or shell escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, etc.) to achieve remote code execution as the web server user (likely root).
Problem types: cwe_id: CWE-78
description: CWE-78 Unauthenticated OS Command Injection (start_upgrade.php)
Affected products: vendor: DB Electronica Telecomunicazioni S.p.A.
product: Mozart FM Transmitter
default_status: unaffected
Credits: lang: en
value: Abdul Mhanni
Published: 2025-11-26T00:36:29.474Z
CVE-2025-66254 Unauthenticated Arbitrary File Deletion (upgrade_contents.php)
Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgrade parameter allows unauthenticated deletion of arbitrary files. 

The `deleteupgrade` parameter in `/var/www/upgrade_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/upload/` without any extension restriction or path sanitization, enabling attackers to remove critical system files.
Problem types: cwe_id: CWE-73
description: CWE-73 Unauthenticated Arbitrary File Deletion (upgrade_contents.php)
Affected products: vendor: DB Electronica Telecomunicazioni S.p.A.
product: Mozart FM Transmitter
default_status: unaffected
Credits: lang: en
value: Abdul Mhanni
Published: 2025-11-26T00:37:48.788Z
CVE-2025-66255 Unauthenticated Arbitrary File Upload (upgrade_contents.php)
Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages. 
The firmware upgrade endpoint in `upgrade_contents.php` accepts arbitrary file uploads without validating file headers, cryptographic signatures, or enforcing .tgz format requirements, allowing malicious firmware injection. This endpoint also subsequently provides ways for arbitrary file uploads and subsequent remote code execution
Problem types: cwe_id: CWE-345
description: CWE-345 Unauthenticated Arbitrary File Upload (upgrade_contents.php)
Affected products: vendor: DB Electronica Telecomunicazioni S.p.A.
product: Mozart FM Transmitter
default_status: unaffected
Credits: lang: en
value: Abdul Mhanni
Published: 2025-11-26T00:39:56.984Z
CVE-2025-66256 Unauthenticated Arbitrary File Upload (patch_contents.php)
Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patch_contents.php allows uploading malicious files.

The `/var/tdf/patch_contents.php` endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files.
Problem types: cwe_id: CWE-434
description: CWE-434 Unauthenticated Arbitrary File Upload (patch_contents.php)
Affected products: vendor: DB Electronica Telecomunicazioni S.p.A.
product: Mozart FM Transmitter
default_status: unaffected
Credits: lang: en
value: Abdul Mhanni
Published: 2025-11-26T00:41:08.666Z
CVE-2025-66257 Unauthenticated Arbitrary File Deletion (patch_contents.php)
Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter allows unauthenticated deletion of arbitrary files.
The `deletepatch` parameter in `patch_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/patch/` directory without sanitization or access control checks.
Problem types: cwe_id: CWE-73
description: CWE-73 Unauthenticated Arbitrary File Deletion (patch_contents.php)
Affected products: vendor: DB Electronica Telecomunicazioni S.p.A.
product: Mozart FM Transmitter
default_status: unaffected
Credits: lang: en
value: Abdul Mhanni
Published: 2025-11-26T00:43:54.408Z
CVE-2025-66258 Stored Cross-Site Scripting via XML Injection
Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Stored XSS via crafted filenames injected into patchlist.xml.
User-controlled filenames are directly concatenated into `patchlist.xml` without encoding, allowing injection of malicious JavaScript payloads via crafted filenames (e.g., `<img src=x onerror=alert()>.bin`). The XSS executes when ajax.js processes and renders the XML file.
Problem types: cwe_id: CWE-79
description: CWE-79 Stored Cross-Site Scripting via XML Injection
Affected products: vendor: DB Electronica Telecomunicazioni S.p.A.
product: Mozart FM Transmitter
default_status: unaffected
Credits: lang: en
value: Abdul Mhanni
Published: 2025-11-26T00:45:39.995Z
CVE-2025-66259 Authenticated Root Remote Code Execution through improper filtering of HTTP post request parameters
Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform in main_ok.php user supplied data/hour/time is passed directly into date shell command
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: DB Electronica Telecomunicazioni S.p.A.
product: Mozart FM Transmitter
default_status: unaffected
Credits: lang: en
value: Abdul Mhanni
Published: 2025-11-26T00:46:51.931Z