xamxte/cve-to-cwe huggingface dataset:
CVE-2023-32842: In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01130256; Issue ID: MOLY01130256 (MSV-848).
CVE-2025-20016: OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an administrative privilege who logged in to the web management page of the affected product may execute an arbitrary OS command.
CVE-2024-31929: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Polevaultweb Intagrate Lite allows Stored XSS.This issue affects Intagrate Lite: from n/a through 1.3.7.
CVE-2023-4782: Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.
CVE-2019-20146: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption.
CVE-2024-1909: The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxRenameCategory function. This makes it possible for unauthenticated attackers to rename categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2022-23125: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the copyapplfile function. When parsing the len element, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15869.
CVE-2022-48223: An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK repair, certutil.exe is called by the Acuant installer to repair certificates. This call is vulnerable to DLL hijacking due to a race condition and insecure permissions on the executing directory.
CVE-2025-36352: IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2021-0162: Improper input validation in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CVE-2018-1096: An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.
CVE-2019-2163: In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118138797
CVE-2009-5046: JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.
CVE-2025-38286: In the Linux kernel, the following vulnerability has been resolved:  pinctrl: at91: Fix possible out-of-boundary access  at91_gpio_probe() doesn't check that given OF alias is not available or something went wrong when trying to get it. This might have consequences when accessing gpio_chips array with that value as an index. Note, that BUG() can be compiled out and hence won't actually perform the required checks.
CVE-2012-5108: Race condition in Google Chrome before 22.0.1229.92 allows remote attackers to execute arbitrary code via vectors related to audio devices.
CVE-2024-13330: The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2018-13521: The mintToken function of a smart contract implementation for PinkyToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVE-2016-2355: SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.
CVE-2024-7950: The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Attackers can also update arbitrary settings and create user accounts even when registration is disabled, leading to user creation with a default role of Administrator.
CVE-2023-52808: In the Linux kernel, the following vulnerability has been resolved:  scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs  If init debugfs failed during device registration due to memory allocation failure, debugfs_remove_recursive() is called, after which debugfs_dir is not set to NULL. debugfs_remove_recursive() will be called again during device removal. As a result, illegal pointer is accessed.  [ 1665.467244] hisi_sas_v3_hw 0000:b4:02.0: failed to init debugfs! ... [ 1669.836708] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [ 1669.872669] pc : down_write+0x24/0x70 [ 1669.876315] lr : down_write+0x1c/0x70 [ 1669.879961] sp : ffff000036f53a30 [ 1669.883260] x29: ffff000036f53a30 x28: ffffa027c31549f8 [ 1669.888547] x27: ffffa027c3140000 x26: 0000000000000000 [ 1669.893834] x25: ffffa027bf37c270 x24: ffffa027bf37c270 [ 1669.899122] x23: ffff0000095406b8 x22: ffff0000095406a8 [ 1669.904408] x21: 0000000000000000 x20: ffffa027bf37c310 [ 1669.909695] x19: 00000000000000a0 x18: ffff8027dcd86f10 [ 1669.914982] x17: 0000000000000000 x16: 0000000000000000 [ 1669.920268] x15: 0000000000000000 x14: ffffa0274014f870 [ 1669.925555] x13: 0000000000000040 x12: 0000000000000228 [ 1669.930842] x11: 0000000000000020 x10: 0000000000000bb0 [ 1669.936129] x9 : ffff000036f537f0 x8 : ffff80273088ca10 [ 1669.941416] x7 : 000000000000001d x6 : 00000000ffffffff [ 1669.946702] x5 : ffff000008a36310 x4 : ffff80273088be00 [ 1669.951989] x3 : ffff000009513e90 x2 : 0000000000000000 [ 1669.957276] x1 : 00000000000000a0 x0 : ffffffff00000001 [ 1669.962563] Call trace: [ 1669.965000]  down_write+0x24/0x70 [ 1669.968301]  debugfs_remove_recursive+0x5c/0x1b0 [ 1669.972905]  hisi_sas_debugfs_exit+0x24/0x30 [hisi_sas_main] [ 1669.978541]  hisi_sas_v3_remove+0x130/0x150 [hisi_sas_v3_hw] [ 1669.984175]  pci_device_remove+0x48/0xd8 [ 1669.988082]  device_release_driver_internal+0x1b4/0x250 [ 1669.993282]  device_release_driver+0x28/0x38 [ 1669.997534]  pci_stop_bus_device+0x84/0xb8 [ 1670.001611]  pci_stop_and_remove_bus_device_locked+0x24/0x40 [ 1670.007244]  remove_store+0xfc/0x140 [ 1670.010802]  dev_attr_store+0x44/0x60 [ 1670.014448]  sysfs_kf_write+0x58/0x80 [ 1670.018095]  kernfs_fop_write+0xe8/0x1f0 [ 1670.022000]  __vfs_write+0x60/0x190 [ 1670.025472]  vfs_write+0xac/0x1c0 [ 1670.028771]  ksys_write+0x6c/0xd8 [ 1670.032071]  __arm64_sys_write+0x24/0x30 [ 1670.035977]  el0_svc_common+0x78/0x130 [ 1670.039710]  el0_svc_handler+0x38/0x78 [ 1670.043442]  el0_svc+0x8/0xc  To fix this, set debugfs_dir to NULL after debugfs_remove_recursive().
CVE-2017-16318: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_sonos, at 0x9d01d16c, the value for the `g_group_off` key is copied using `strcpy` to the buffer at `$sp+0x2b0`.This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
CVE-2023-28380: Uncontrolled search path for the Intel(R) AI Hackathon software before version 2.0.0 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVE-2019-12788: An issue was discovered in Photodex ProShow Producer v9.0.3797 (an application that runs with Administrator privileges). It is possible to perform a buffer overflow via a crafted file.
CVE-2025-23655: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Contact Form 7 – Paystack Add-on allows Reflected XSS. This issue affects Contact Form 7 – Paystack Add-on: from n/a through 1.2.3.
CVE-2019-1197: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. The security update addresses the vulnerability by modifying how the Chakra scripting engine handles objects in memory.
CVE-2024-26466: A DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platform-tests/wpt before commit 938e843 allows attackers to execute arbitrary Javascript via sending a crafted URL.
CVE-2024-26454: A Cross Site Scripting vulnerability in Healthcare-Chatbot through 9b7058a can occur via a crafted payload to the email1 or pwd1 parameter in login.php.
CVE-2024-12201: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.
CVE-2022-25083: TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVE-2012-6655: An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords.
CVE-2013-3863: Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allow remote attackers to execute arbitrary code via a crafted OLE object in a file, aka "OLE Property Vulnerability."
CVE-2025-60009: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the   CLI Configlet   page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.  This issue affects all versions of Junos Space before 24.1R4.
CVE-2010-0547: client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.
CVE-2016-9484: The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any PHP form code generated by this website prior to 2016-12-06 may be vulnerable.
CVE-2019-16995: In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d.
CVE-2023-20751: In keymange, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07825502; Issue ID: ALPS07825502.
CVE-2024-56811: IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
CVE-2020-27990: Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
CVE-2018-25156: Teradek Cube 7.3.6 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft a malicious web page with a hidden form to submit password change requests to the device's system configuration interface.
CVE-2024-32752: The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access
CVE-2022-41576: The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programs to be implanted on user devices.
CVE-2020-13462: Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA.
CVE-2019-11888: Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain sensitive information or gain privileges.
CVE-2012-6074: Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
CVE-2023-28659: The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] parameter of the pbc_save_downs action.
CVE-2023-31747: Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attackers to launch processes with elevated privileges.
CVE-2022-2380: The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel.
CVE-2021-34348: A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later
CVE-2024-4926: A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /intrams_sams/manage_student.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264462 is the identifier assigned to this vulnerability.
CVE-2021-47540: In the Linux kernel, the following vulnerability has been resolved:  mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode  Fix the following NULL pointer dereference in mt7915_get_phy_mode routine adding an ibss interface to the mt7915 driver.  [  101.137097] wlan0: Trigger new scan to find an IBSS to join [  102.827039] wlan0: Creating new IBSS network, BSSID 26:a4:50:1a:6e:69 [  103.064756] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [  103.073670] Mem abort info: [  103.076520]   ESR = 0x96000005 [  103.079614]   EC = 0x25: DABT (current EL), IL = 32 bits [  103.084934]   SET = 0, FnV = 0 [  103.088042]   EA = 0, S1PTW = 0 [  103.091215] Data abort info: [  103.094104]   ISV = 0, ISS = 0x00000005 [  103.098041]   CM = 0, WnR = 0 [  103.101044] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000460b1000 [  103.107565] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [  103.116590] Internal error: Oops: 96000005 [#1] SMP [  103.189066] CPU: 1 PID: 333 Comm: kworker/u4:3 Not tainted 5.10.75 #0 [  103.195498] Hardware name: MediaTek MT7622 RFB1 board (DT) [  103.201124] Workqueue: phy0 ieee80211_iface_work [mac80211] [  103.206695] pstate: 20000005 (nzCv daif -PAN -UAO -TCO BTYPE=--) [  103.212705] pc : mt7915_get_phy_mode+0x68/0x120 [mt7915e] [  103.218103] lr : mt7915_mcu_add_bss_info+0x11c/0x760 [mt7915e] [  103.223927] sp : ffffffc011cdb9e0 [  103.227235] x29: ffffffc011cdb9e0 x28: ffffff8006563098 [  103.232545] x27: ffffff8005f4da22 x26: ffffff800685ac40 [  103.237855] x25: 0000000000000001 x24: 000000000000011f [  103.243165] x23: ffffff8005f4e260 x22: ffffff8006567918 [  103.248475] x21: ffffff8005f4df80 x20: ffffff800685ac58 [  103.253785] x19: ffffff8006744400 x18: 0000000000000000 [  103.259094] x17: 0000000000000000 x16: 0000000000000001 [  103.264403] x15: 000899c3a2d9d2e4 x14: 000899bdc3c3a1c8 [  103.269713] x13: 0000000000000000 x12: 0000000000000000 [  103.275024] x11: ffffffc010e30c20 x10: 0000000000000000 [  103.280333] x9 : 0000000000000050 x8 : ffffff8006567d88 [  103.285642] x7 : ffffff8006563b5c x6 : ffffff8006563b44 [  103.290952] x5 : 0000000000000002 x4 : 0000000000000001 [  103.296262] x3 : 0000000000000001 x2 : 0000000000000001 [  103.301572] x1 : 0000000000000000 x0 : 0000000000000011 [  103.306882] Call trace: [  103.309328]  mt7915_get_phy_mode+0x68/0x120 [mt7915e] [  103.314378]  mt7915_bss_info_changed+0x198/0x200 [mt7915e] [  103.319941]  ieee80211_bss_info_change_notify+0x128/0x290 [mac80211] [  103.326360]  __ieee80211_sta_join_ibss+0x308/0x6c4 [mac80211] [  103.332171]  ieee80211_sta_create_ibss+0x8c/0x10c [mac80211] [  103.337895]  ieee80211_ibss_work+0x3dc/0x614 [mac80211] [  103.343185]  ieee80211_iface_work+0x388/0x3f0 [mac80211] [  103.348495]  process_one_work+0x288/0x690 [  103.352499]  worker_thread+0x70/0x464 [  103.356157]  kthread+0x144/0x150 [  103.359380]  ret_from_fork+0x10/0x18 [  103.362952] Code: 394008c3 52800220 394000e4 7100007f (39400023)
CVE-2024-34488: OFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0.
CVE-2018-4924: Adobe Dreamweaver CC versions 18.0 and earlier have an OS Command Injection vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2025-13911: The vulnerability affects Ignition SCADA applications where Python  scripting is utilized for automation purposes. The vulnerability arises  from the absence of proper security controls that restrict which Python  libraries can be imported and executed within the scripting environment.  The core issue lies in the Ignition service account having system  permissions beyond what an Ignition privileged user requires. When an  authenticated administrator uploads a malicious project file containing  Python scripts with bind shell capabilities, the application executes  these scripts with the same privileges as the Ignition Gateway process,  which typically runs with SYSTEM-level permissions on Windows.  Alternative code execution patterns could lead to similar results.
CVE-2024-37906: Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.
CVE-2024-10185: The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-youtube-embed shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2023-6452: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.      The  Forcepoint Web Security portal allows administrators to generate  detailed reports on user requests made through the Web proxy. It has  been determined that the "user agent" field in the Transaction Viewer is  vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability,  which can be exploited by any user who can route traffic through the  Forcepoint Web proxy.  This  vulnerability enables unauthorized attackers to execute JavaScript  within the browser context of a Forcepoint administrator, thereby  allowing them to perform actions on the administrator's behalf. Such a  breach could lead to unauthorized access or modifications, posing a  significant security risk.       This issue affects Web Security: before 8.5.6.
CVE-2019-14298: Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.
CVE-2023-4611: A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak.
CVE-2019-7676: A weak password vulnerability was discovered in Enphase Envoy R3.*.*. One can login via TCP port 8888 with the admin password for the admin account.
CVE-2019-6972: An issue was discovered on TP-Link TL-WR1043ND V2 devices. The credentials can be easily decoded and cracked by brute-force, WordList, or Rainbow Table attacks. Specifically, credentials in the "Authorization" cookie are encoded with URL encoding and base64, leading to easy decoding. Also, the username is cleartext, and the password is hashed with the MD5 algorithm (after decoding of the URL encoded string with base64).
CVE-2016-5000: The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.