rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-67115 
A path traversal vulnerability in /ftl/web/setup.cgi in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote authenticated users to read arbitrary files from the filesystem via crafted values in the log_type parameter to /logsave.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-19T00:00:00.000Z
CVE-2025-67124 
A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-67125 
A signed integer overflow in docopt.cpp v0.6.2 (LeafPattern::match in docopt_private.h) when merging occurrence counters (e.g., default LONG_MAX + first user "-v/--verbose") can cause counter wrap (negative/unbounded semantics) and lead to logic/policy bypass in applications that rely on occurrence-based limits, rate-gating, or safety toggles. In hardened builds (e.g., UBSan or -ftrapv), the overflow may also result in process abort (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-67133 
An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-09T00:00:00.000Z
CVE-2025-67135 
Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-11T00:00:00.000Z
CVE-2025-67146 
Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.php, and (3) gym_search.php, and via the 'id' parameter in (4) payment_search.php. An unauthenticated remote attacker can exploit these issues to inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or modification of database contents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-12T00:00:00.000Z
CVE-2025-67147 
Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_contact.php, the 'username' and 'pass_key' parameters in (2) secure_login.php, and the 'login_id', 'pwfield', and 'login_key' parameters in (3) change_s_pwd.php. An unauthenticated or authenticated attacker can exploit these issues to bypass authentication, execute arbitrary SQL commands, modify database records, delete data, or escalate privileges to administrator level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-12T00:00:00.000Z
CVE-2025-67158 
An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and escalate privileges via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-02T00:00:00.000Z
CVE-2025-67159 
Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-02T00:00:00.000Z
CVE-2025-67160 
An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-02T00:00:00.000Z
CVE-2025-67163 
A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-18T00:00:00.000Z
CVE-2025-67164 
An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67165 
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67168 
RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67170 
A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67171 
Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67172 
RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67173 
A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67174 
A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal in the admin_language_file and default_page_language_file in the admin.php component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67186 
TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so. The vulnerability occurs because the `url` parameter is not properly validated for length, allowing remote attackers to trigger a buffer overflow, potentially leading to arbitrary code execution or denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-03T00:00:00.000Z
CVE-2025-67187 
A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The flaw exists in the setIpQosRules interface of /lib/cste_modules/firewall.so where the comment parameter is not properly validated for length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-03T00:00:00.000Z
CVE-2025-67188 
A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The issue resides in the setRadvdCfg interface of the /lib/cste_modules/ipv6.so module. The function fails to properly validate the length of the user-controlled radvdinterfacename parameter, allowing remote attackers to trigger a stack buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-03T00:00:00.000Z
CVE-2025-67189 
A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112. The urlKeyword parameter is not properly validated, and the function concatenates multiple user-controlled fields into a fixed-size stack buffer without performing boundary checks. A remote attacker can exploit this flaw to cause denial of service or potentially achieve arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-03T00:00:00.000Z
CVE-2025-67202 
Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-07T00:00:00.000Z
CVE-2025-67221 
The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-22T00:00:00.000Z
CVE-2025-67223 
The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls to download sensitive documents containing PII.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-28T00:00:00.000Z
CVE-2025-67229 
An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting insufficient certificate validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-67230 
Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to invoke external protocol handlers without sufficient validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-67231 
A reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-67246 
A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler. This driver exposes a device interface accessible to a normal user and handles attacker-controlled structures containing the lower 4GB of physical addresses. The handler maps arbitrary physical memory via MmMapIoSpace and copies data back to user mode without verifying the caller's privileges or the target address range. This allows unprivileged users to read arbitrary physical memory, potentially exposing kernel data structures, kernel pointers, security tokens, and other sensitive information. This vulnerability can be further exploited to bypass the Kernel Address Space Layout Rules (KASLR) and achieve local privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2025-67254 
NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-29T00:00:00.000Z
CVE-2025-67255 
In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-29T00:00:00.000Z
CVE-2025-67259 
A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint results in disclosure of sensitive information including other students details, tutor/admin profiles, and internal course metadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-24T00:00:00.000Z
CVE-2025-67260 
The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack TpkWebGIS Client 1.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-20T00:00:00.000Z
CVE-2025-67261 
Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-20T00:00:00.000Z
CVE-2025-67263 
Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The application fails to properly sanitize user-supplied input stored in the Name and Surname fields. An attacker can insert malicious HTML or script content into these fields, which, persisted in the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-20T00:00:00.000Z
CVE-2025-67264 
An OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59, Note59 Pro, and Note59 Pro+ allows a local attacker to execute arbitrary code and escalate privileges via the EngineerMode ADB shell, due to incomplete patching of CVE-2025-31710
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-23T00:00:00.000Z
CVE-2025-67268 
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-02T00:00:00.000Z
CVE-2025-67269 
An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer->length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-02T00:00:00.000Z
CVE-2025-67274 
An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download module, integration-persistence-service job listing module, portfolio-item-service data retrieval module endpoints
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-26T00:00:00.000Z
CVE-2025-67278 
An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP request
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-09T00:00:00.000Z
CVE-2025-67279 
An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashes in MD5 format
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-09T00:00:00.000Z
CVE-2025-67280 
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-09T00:00:00.000Z
CVE-2025-67281 
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the database and its content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-09T00:00:00.000Z
CVE-2025-67282 
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download password hashes of other user, access work items of other user, modify restricted content in workflows, modify the applications logo and manipulate the profile of other user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-09T00:00:00.000Z
CVE-2025-67285 
A SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID Tracking System Using QR-Code v1.0. The reason for this issue is that attackers inject malicious code from the parameter 'id' and use it directly in SQL queries without the need for appropriate cleaning or validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2025-67288 
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself, a related issue to CVE-2023-49279.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-22T00:00:00.000Z
CVE-2025-67289 
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-22T00:00:00.000Z
CVE-2025-67290 
A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Excerpt field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-22T00:00:00.000Z
CVE-2025-67291 
A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-22T00:00:00.000Z
CVE-2025-67298 
An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-11T00:00:00.000Z
CVE-2025-67303 
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-05T00:00:00.000Z
CVE-2025-67304 
In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configuration, the PostgreSQL service is accessible over the network on TCP port 5432. An attacker can use the hardcoded credentials to authenticate remotely, gaining superuser access to the database. This allows creation of administrative users for the web interface, extraction of password hashes, and execution of arbitrary OS commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-19T00:00:00.000Z
CVE-2025-67305 
In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deployments, allowing an attacker with network access to authenticate via SSH without a password. Once authenticated, the attacker can access the PostgreSQL database with superuser privileges, create administrative users for the web interface, and potentially escalate privileges further.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-19T00:00:00.000Z
CVE-2025-67316 
An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser. NOTE: The supplier is currently disputing this finding and the record is under review.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-05T00:00:00.000Z
CVE-2025-67325 
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-08T00:00:00.000Z
CVE-2025-67341 
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-12T00:00:00.000Z
CVE-2025-67342 
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-12T00:00:00.000Z
CVE-2025-67344 
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-12T00:00:00.000Z
CVE-2025-67349 
A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-26T00:00:00.000Z
CVE-2025-67364 
fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability arises from improper path validation that fails to resolve symbolic links to their actual physical paths. The safePath and isPathAllowed functions use path.resolve() which does not handle symlinks, allowing attackers to bypass directory access restrictions by creating symlinks within allowed directories that point to restricted system paths. When these symlinks are accessed through valid path references, the validation checks are circumvented, enabling access to unauthorized files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-07T00:00:00.000Z