stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2025-21136 (severity: HIGH, weakness: CWE-787)
Substance3D - Designer versions 14.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21137 (severity: HIGH, weakness: CWE-122)
Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21138 (severity: HIGH, weakness: CWE-787)
Substance3D - Designer versions 14.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21139 (severity: HIGH, weakness: CWE-122)
Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-2114 (severity: MEDIUM, weakness: CWE-266)
A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This issue affects some unknown processing of the file /WebPages/Adm/OperatorStop.asp of the component Reset Password Interface. The manipulation of the argument OperId leads to improper authorization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2115 (severity: MEDIUM, weakness: CWE-284)
A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of the file /AcceptZip.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21155 (severity: MEDIUM, weakness: CWE-476)
Substance3D - Stager versions 3.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21156 (severity: HIGH, weakness: CWE-191)
InCopy versions 20.0, 19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21157 (severity: HIGH, weakness: CWE-787)
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21158 (severity: HIGH, weakness: CWE-191)
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21159 (severity: HIGH, weakness: CWE-416)
Illustrator versions 29.1, 28.7.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-2116 (severity: MEDIUM, weakness: CWE-918)
A vulnerability has been found in Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /newsedit/newsedit/xy/imageProxy.do of the component File Protocol Handler. The manipulation of the argument xyImgUrl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21160 (severity: HIGH, weakness: CWE-191)
Illustrator versions 29.1, 28.7.3 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21161 (severity: HIGH, weakness: CWE-787)
Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21162 (severity: MEDIUM, weakness: CWE-379)
Photoshop Elements versions 2025.0 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21163 (severity: HIGH, weakness: CWE-121)
Illustrator versions 29.1, 28.7.3 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21169 (severity: HIGH, weakness: CWE-122)
Substance3D - Designer versions 14.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-2117 (severity: MEDIUM, weakness: CWE-74)
A vulnerability was found in Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0 and classified as critical. Affected by this issue is the function electricDocList of the file /newsedit/report/reportCenter.do. The manipulation of the argument fvID/catID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21170 (severity: MEDIUM, weakness: CWE-476)
Substance3D - Modeler versions 1.15.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-21171 (severity: HIGH, weakness: CWE-122)
.NET Remote Code Execution Vulnerability
CVE-2025-21172 (severity: HIGH, weakness: CWE-122)
.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2025-21173 (severity: HIGH, weakness: CWE-379)
.NET Elevation of Privilege Vulnerability
CVE-2025-21174 (severity: HIGH, weakness: CWE-400)
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVE-2025-21176 (severity: HIGH, weakness: CWE-126)
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2025-21177 (severity: HIGH, weakness: CWE-918)
Server-Side Request Forgery (SSRF) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network.
CVE-2025-21178 (severity: HIGH, weakness: CWE-122)
Visual Studio Remote Code Execution Vulnerability
CVE-2025-21179 (severity: MEDIUM, weakness: CWE-125)
DHCP Client Service Denial of Service Vulnerability
CVE-2025-2118 (severity: MEDIUM, weakness: CWE-74)
A vulnerability was found in Quantico Tecnologia PRMV 6.48. It has been classified as critical. This affects an unknown part of the file /admin/login.php of the component Login Endpoint. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-21180 (severity: HIGH, weakness: CWE-122)
Heap-based buffer overflow in Windows exFAT File System allows an unauthorized attacker to execute code locally.
CVE-2025-21181 (severity: HIGH, weakness: CWE-400)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-21182 (severity: HIGH, weakness: CWE-415)
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
CVE-2025-21183 (severity: HIGH, weakness: CWE-415)
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
CVE-2025-21184 (severity: HIGH, weakness: CWE-122)
Windows Core Messaging Elevation of Privileges Vulnerability
CVE-2025-21185 (severity: MEDIUM, weakness: CWE-284)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2025-21186 (severity: HIGH, weakness: CWE-122)
Microsoft Access Remote Code Execution Vulnerability
CVE-2025-21187 (severity: HIGH, weakness: CWE-94)
Microsoft Power Automate Remote Code Execution Vulnerability
CVE-2025-21188 (severity: MEDIUM, weakness: CWE-59)
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
CVE-2025-21189 (severity: MEDIUM, weakness: CWE-41)
MapUrlToZone Security Feature Bypass Vulnerability
CVE-2025-2119 (severity: LOW, weakness: CWE-1392)
A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been declared as problematic. This vulnerability affects unknown code of the component Device Registration Handler. The manipulation leads to use of default credentials. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21190 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21191 (severity: HIGH, weakness: CWE-367)
Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
CVE-2025-21193 (severity: MEDIUM, weakness: CWE-352)
Active Directory Federation Server Spoofing Vulnerability
CVE-2025-21194 (severity: HIGH, weakness: CWE-20)
Microsoft Surface Security Feature Bypass Vulnerability
CVE-2025-21197 (severity: MEDIUM, weakness: CWE-284)
Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content.
CVE-2025-21198 (severity: CRITICAL, weakness: CWE-306)
Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability
CVE-2025-21199 (severity: MEDIUM, weakness: CWE-269)
Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.
CVE-2025-2120 (severity: LOW, weakness: CWE-312)
A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been rated as problematic. This issue affects some unknown processing of the file /tmp/hostapd.conf of the component Configuration File Handler. The manipulation leads to cleartext storage in a file or on disk. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21200 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21201 (severity: HIGH, weakness: CWE-415)
Windows Telephony Server Remote Code Execution Vulnerability
CVE-2025-21202 (severity: MEDIUM, weakness: CWE-284)
Windows Recovery Environment Agent Elevation of Privilege Vulnerability
CVE-2025-21203 (severity: MEDIUM, weakness: CWE-126)
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVE-2025-21204 (severity: HIGH, weakness: CWE-59)
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
CVE-2025-21205 (severity: HIGH, weakness: CWE-122)
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVE-2025-21206 (severity: HIGH, weakness: CWE-427)
Visual Studio Installer Elevation of Privilege Vulnerability
CVE-2025-21207 (severity: HIGH, weakness: CWE-400)
Windows Connected Devices Platform Service (Cdpsvc) Denial of Service Vulnerability
CVE-2025-21208 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-2121 (severity: MEDIUM, weakness: CWE-266)
A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File Storage. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21210 (severity: MEDIUM, weakness: CWE-636)
Windows BitLocker Information Disclosure Vulnerability
CVE-2025-21211 (severity: MEDIUM, weakness: CWE-693)
Secure Boot Security Feature Bypass Vulnerability
CVE-2025-21212 (severity: MEDIUM, weakness: CWE-125)
Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVE-2025-21213 (severity: MEDIUM, weakness: CWE-284)
Secure Boot Security Feature Bypass Vulnerability
CVE-2025-21214 (severity: MEDIUM, weakness: CWE-200)
Windows BitLocker Information Disclosure Vulnerability
CVE-2025-21215 (severity: MEDIUM, weakness: CWE-125)
Secure Boot Security Feature Bypass Vulnerability
CVE-2025-21216 (severity: MEDIUM, weakness: CWE-125)
Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVE-2025-21217 (severity: MEDIUM, weakness: CWE-693)
Windows NTLM Spoofing Vulnerability
CVE-2025-21218 (severity: HIGH, weakness: CWE-400)
Windows Kerberos Denial of Service Vulnerability
CVE-2025-21219 (severity: MEDIUM, weakness: CWE-41)
MapUrlToZone Security Feature Bypass Vulnerability
CVE-2025-2122 (severity: LOW, weakness: CWE-404)
A vulnerability classified as problematic was found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected by this vulnerability is an unknown functionality of the component Connection Handler. The manipulation leads to denial of service. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21220 (severity: HIGH, weakness: CWE-908)
Microsoft Message Queuing Information Disclosure Vulnerability
CVE-2025-21221 (severity: HIGH, weakness: CWE-122)
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVE-2025-21222 (severity: HIGH, weakness: CWE-122)
Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVE-2025-21223 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21224 (severity: HIGH, weakness: CWE-416)
Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
CVE-2025-21225 (severity: MEDIUM, weakness: CWE-843)
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
CVE-2025-21226 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21227 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21228 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21229 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-2123 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function get_var of the file /contrib/cssgen.php of the component CSS Handler. The manipulation of the argument default-styles/keywords-1/keywords-2/keywords-3/keywords-4/comments leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-21230 (severity: HIGH, weakness: CWE-20)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-21231 (severity: HIGH, weakness: CWE-400)
IP Helper Denial of Service Vulnerability
CVE-2025-21232 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21233 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21234 (severity: HIGH, weakness: CWE-20)
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
CVE-2025-21235 (severity: HIGH, weakness: CWE-20)
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
CVE-2025-21236 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21237 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21238 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21239 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-2124 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.svc/change_password of the component API Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21240 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21241 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21242 (severity: MEDIUM, weakness: CWE-200)
Windows Kerberos Information Disclosure Vulnerability
CVE-2025-21243 (severity: HIGH, weakness: CWE-190)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21244 (severity: HIGH, weakness: CWE-190)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21245 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21246 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21247 (severity: MEDIUM, weakness: CWE-41)
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
CVE-2025-21248 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21249 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-2125 (severity: MEDIUM, weakness: CWE-99)
A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/comprovante_marcacao/?companyId=1 of the component PDF Document Handler. The manipulation of the argument nsr leads to improper control of resource identifiers. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21250 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21251 (severity: HIGH, weakness: CWE-400)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-21252 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21253 (severity: MEDIUM, weakness: CWE-451)
Microsoft Edge for IOS and Android Spoofing Vulnerability
CVE-2025-21254 (severity: MEDIUM, weakness: CWE-125)
Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVE-2025-21255 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21256 (severity: MEDIUM, weakness: CWE-122)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21257 (severity: MEDIUM, weakness: CWE-125)
Windows WLAN AutoConfig Service Information Disclosure Vulnerability
CVE-2025-21258 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21259 (severity: MEDIUM, weakness: CWE-451)
Microsoft Outlook Spoofing Vulnerability
CVE-2025-2126 (severity: MEDIUM, weakness: CWE-74)
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the argument title leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21260 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21261 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21262 (severity: MEDIUM, weakness: CWE-451)
User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network
CVE-2025-21263 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21264 (severity: HIGH, weakness: CWE-552)
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2025-21265 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21266 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21267 (severity: MEDIUM, weakness: CWE-358)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-21268 (severity: MEDIUM, weakness: CWE-41)
MapUrlToZone Security Feature Bypass Vulnerability
CVE-2025-21269 (severity: MEDIUM, weakness: CWE-41)
Windows HTML Platforms Security Feature Bypass Vulnerability