CIRCL/vulnerability-scores huggingface dataset:
CVE-2023-38648 
Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_get_facname decompression functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the prefix copy loop.
CVSS v3.1 score: 7.8
CVE-2025-38229 media: cxusb: no longer judge rbuf when the write fails
In the Linux kernel, the following vulnerability has been resolved:

media: cxusb: no longer judge rbuf when the write fails

syzbot reported a uninit-value in cxusb_i2c_xfer. [1]

Only when the write operation of usb_bulk_msg() in dvb_usb_generic_rw()
succeeds and rlen is greater than 0, the read operation of usb_bulk_msg()
will be executed to read rlen bytes of data from the dvb device into the
rbuf.

In this case, although rlen is 1, the write operation failed which resulted
in the dvb read operation not being executed, and ultimately variable i was
not initialized.

[1]
BUG: KMSAN: uninit-value in cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline]
BUG: KMSAN: uninit-value in cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196
 cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline]
 cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196
 __i2c_transfer+0xe25/0x3150 drivers/i2c/i2c-core-base.c:-1
 i2c_transfer+0x317/0x4a0 drivers/i2c/i2c-core-base.c:2315
 i2c_transfer_buffer_flags+0x125/0x1e0 drivers/i2c/i2c-core-base.c:2343
 i2c_master_send include/linux/i2c.h:109 [inline]
 i2cdev_write+0x210/0x280 drivers/i2c/i2c-dev.c:183
 do_loop_readv_writev fs/read_write.c:848 [inline]
 vfs_writev+0x963/0x14e0 fs/read_write.c:1057
 do_writev+0x247/0x5c0 fs/read_write.c:1101
 __do_sys_writev fs/read_write.c:1169 [inline]
 __se_sys_writev fs/read_write.c:1166 [inline]
 __x64_sys_writev+0x98/0xe0 fs/read_write.c:1166
 x64_sys_call+0x2229/0x3c80 arch/x86/include/generated/asm/syscalls_64.h:21
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
CVSS v3.1 score: 5.5
CVE-2017-18390 
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
CVE-2007-4063 
Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable menu items as privileged users, related to improper use of HTTP GET and the Forms API.
CVSS v2.0 score: 4.3
CVE-2017-6790 
A vulnerability in the Session Initiation Protocol (SIP) on the Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the targeted appliance. The vulnerability is due to excessive SIP traffic sent to the device. An attacker could exploit this vulnerability by transmitting large volumes of SIP traffic to the VCS. An exploit could allow the attacker to cause a complete DoS condition on the targeted system. Cisco Bug IDs: CSCve32897.
CVSS v3.0 score: 6.8
CVSS v2.0 score: 7.1
GHSA-24j2-327w-xq74 
Product: AndroidVersions: Android kernelAndroid ID: A-235292841References: N/A
CVSS v3.1 score: 9.8
CVE-2014-8635 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS v2.0 score: 7.5
CVE-2015-8125 
Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.
CVSS v2.0 score: 7.5
GHSA-6jw6-77q7-32wq 
The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an attacker with physical access to the device can connect over this port and reflash the device's firmware with malicious code which will be executed upon running. As a result, the victim will lose access to the functionality of their device and the attack may gain unauthorized access to the victim's Wi-Fi network by re-connecting to the SSID defined in the NVS partition of the device.
CVSS v3.1 score: 6.8
CVE-2024-0819 Incomplete protection of personal password settings

Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low privileged user to elevate privileges by changing the personal password setting and establishing a remote connection to a logged-in admin account.


CVSS v3.1 score: 7.3
RHSA-2015:2519 Red Hat Security Advisory: thunderbird security update
Mozilla: Miscellaneous memory safety hazards (rv:38.4) (MFSA 2015-116) Mozilla: Buffer overflow during image interactions in canvas (MFSA 2015-123) Mozilla: CORS preflight is bypassed when non-standard Content-Type headers are received (MFSA 2015-127) Mozilla: Mixed content WebSocket policy bypass through workers (MFSA 2015-132) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131)
CVE-2026-26861 
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, which can be bypassed by an attacker using a subdomain
CVSS v3.1 score: 8.3
CVE-2019-13623 
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis result is archived for sharing with other persons. To achieve arbitrary code execution, one approach is to overwrite some critical Ghidra modules, e.g., the decompile module.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
GHSA-w2qm-hvp5-mjwc 
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Fast Total Search: from n/a through 1.79.262.
CVSS v3.1 score: 4.3
CVE-2014-6910 
The MemorizeIt! (aka com.kshinenterprises.kshinent.memorizeit) application 1.7.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
GHSA-jh27-8mvh-57qm 
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.
CVSS v3.1 score: 6.1
GHSA-g67w-cmqc-xp9h 
SQL injection vulnerability in Zoph 0.7.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different issue than CVE-2008-3258.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2013-5383 
IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to gain privileges via unspecified vectors, a different vulnerability than CVE-2013-5382.
CVSS v2.0 score: 4
RHSA-2025:16115 Red Hat Security Advisory: gnutls security, bug fix, and enhancement update
gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() gnutls: Vulnerability in GnuTLS otherName SAN export gnutls: Vulnerability in GnuTLS SCT extension parsing gnutls: Vulnerability in GnuTLS certtool template parsing
CVSS v3.1 score: 6.5
GHSA-2m5h-vv32-6gjr 
Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in log files, potentially leading to unauthorized database access.
CVSS v4.0 score: 5.4
GHSA-5vqh-8cmq-gmwm 
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS v3.1 score: 7.8
CVE-2020-13664 
Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 9.3
GHSA-9jj6-9j22-g3rv 
SQL injection vulnerability in index.php in CMSQlite 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the c parameter.
CVE-2025-21504 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 4.9
RHSA-2025:7425 Red Hat Security Advisory: osbuild-composer security update
golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
CVSS v3.1 score: 7.5
GHSA-26p9-67p6-4x27 
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS v3.1 score: 10
GHSA-3f3v-mh9q-2pxq 
libxml2 in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
CVSS v3.0 score: 9.8
GHSA-m868-6r8g-x6r5 
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
CVSS v3.1 score: 8.8
CVE-2005-1429 
SQL injection vulnerability in login.asp in WWWguestbook 1.1 allows remote attackers to execute arbitrary SQL commands via the password parameter.
CVSS v2.0 score: 7.5
RHSA-2021:3653 Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.1.11 security fix and container updates
nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name
CVSS v3.1 score: 8.1
CVE-2025-8321 Tesla Wall Connector Firmware Downgrade Vulnerability
Tesla Wall Connector Firmware Downgrade Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware upgrade feature. The issue results from the lack of an anti-downgrade mechanism. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the device. Was ZDI-CAN-26299.
CVSS v3.0 score: 6.8
GHSA-hfgr-56jc-3hcm 
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.
CVE-2012-6336 
The Missing Device feature in Lookout allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."
CVSS v2.0 score: 3.3
CVE-2024-46470 
Cross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the membership_type field in the edit-type.php component.
CVSS v3.1 score: 6.1
GHSA-7f33-7337-2rhg 
in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered.
CVSS v3.1 score: 8.4
CVE-2016-7060 
The web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display.
CVSS v3.0 score: 4.6
CVSS v2.0 score: 2.1
GHSA-j3px-q95c-9683 zlib-rs stack overflow during decompression with malicious input
A denial of service vulnerability was found in zlib-rs, triggered by specially constructed input. This input causes a stack overflow, resulting in the process using zlib-rs to crash.ImpactDue to the way LLVM handles the zlib-rs codebase, tail calls were not guaranteed. This caused certain input patterns to result in a large number of stack frames being required, quickly resulting in a stack overflow. These are unlikely to occur in practice, but a dedicated attacker can construct malicious input files.After stack overflows were found by @inahga with a fuzzer, we dove into the assembly, and found some cases where the stack grewLLVM wants to centralize the cleanup before the return (many other blocks jump to `LBB109_311`), thereby invalidating a tail call to `type_do`. We were not able to get rid of this call without introducing one elsewhere: we just don't currently have the power to tell LLVM what we want it to do.So, we switch back to loop+match waiting for changes to rust to make a more efficient implementation possible. Performance-wise, the damage is relatively minimal: we're just slower in cases where we already were slower than C. We are faster in cases where the relevant code is barely touched (in these cases the logic quickly moves into a hot inner loop and just spends most of its time there).PatchesVersion 0.4.0 patches the problem and is no longer vulnerable.WorkaroundsUsers of zlib-rs should upgrade to the latest version. Users could alternatively run zlib-rs in a separate process to prevent a stack overflow crashing the entire program. In some situations a signal handler can be used to catch a stack overflow happening.
CVSS v3.1 score: 5.3
GHSA-m95x-799j-2j8h 
In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.
CVSS v3.1 score: 9.8
CVE-2024-49211 
Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the context of the vulnerable web application.
CVSS v3.1 score: 5.2
GHSA-6fqv-986c-7cv3 
SQL injection vulnerability in viewtopic.asp in VieBoard 2.6 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
RHSA-2026:40030 Red Hat Security Advisory: OpenShift Container Platform 4.12.94 bug fix and security update
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code
CVSS v3.1 score: 6.5
GHSA-r6wm-q4gx-9q2v 
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_eps.php.
CVSS v3.1 score: 3.8
CVE-2020-11151 
Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS v3.1 score: 6.4
CVSS v2.0 score: 6.9
RHSA-2021:4235 Red Hat Security Advisory: jasper security update
jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c jasper: Out of bounds read in jp2_decode() in jp2_dec.c jasper: NULL pointer dereference in jp2_decode() in jp2_dec.c
CVSS v3.1 score: 5.5
GHSA-v8h5-8jrj-vq7c 
The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.
CVSS v3.1 score: 7.8
GHSA-r35w-2gcj-cx97 
In the Linux kernel, the following vulnerability has been resolved:drm/xe: fix NPD in bo_meminfo()When a buffer object is purged, its ttm.resource is set to NULL via the
TTM pipeline gutting flow. However, the BO remains in the client's
object list until userspace explicitly closes the GEM handle. If memory
stats are queried during this time, accessing bo->ttm.resource->mem_type
will result in a NULL pointer dereference.Fix this by safely skipping purged BOs in bo_meminfo, as they no longer
consume any memory.User is getting NPD on device resume, and possible theory is that in
bo_move(), if we need to evict something to SYSTEM to save the CCS state,
but the BO is marked as dontneed, this won't trigger a move but will
nuke the pages, leaving us with a NULL bo resource. And the meminfo()
doesn't look ready to handle a NULL resource.v2 (Sashiko):There could potentially be other cases where we might end up with a
NULL resource, so make this a general NULL check for now.(cherry picked from commit c9a8e7daa0afe3161111e27fd92176e608c7f186)
GHSA-4f7w-7vpj-f9cf 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wanderic wanderic allows PHP Local File Inclusion.This issue affects Wanderic: from n/a through <= 1.0.10.
CVSS v3.1 score: 8.1
GHSA-2jqp-6hx7-phh8 
A vulnerability has been found in ChatGPTNextWeb NextChat up to 2.16.1. Affected is the function addMcpServer of the file app/mcp/actions.ts. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
CVE-2019-16138 
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2017-9954 
The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted tekhex file, as demonstrated by mishandling within the nm program.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
CVE-2022-2612 
Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS v3.1 score: 6.5
CVE-2025-5408 WAVLINK WL-WN576K1 HTTP POST Request login.cgi sys_login buffer overflow
A vulnerability was found in WAVLINK QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3 and WL-WN576K1 up to V1410_240222 and classified as critical. Affected by this issue is the function sys_login of the file /cgi-bin/login.cgi of the component HTTP POST Request Handler. The manipulation of the argument login_page leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2018-4002 
An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packets, the firewall unsafely handles label compression pointers, leading to an uncontrolled recursion that eventually exhausts the stack, crashing the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability.
CVSS v3.0 score: 5.3
GHSA-qp7j-x725-g67f HydrAIDE Authentication Bypass Vulnerability
SummaryThere is no authentication of any kind.DetailsTLS is implemented, the tunnel between the client and server is secure, however once data is on the server, it's free to be read by any adversaries.On the client side : https://github.com/hydraide/hydraide/blob/main/sdk/go/hydraidego/client/client.go#L221
It should be using a TLS Config with RootCAs and Certificates, currently RootCAs only (under NewClientTLSFromFile)And on the server side, there should be ClientCAs and ClientAuth filled.PoCTo bypass as is, the simplest way is to take the client and modify the code as such :Modified from https://github.com/hydraide/hydraide/blob/main/sdk/go/hydraidego/client/client.go#L209ImpactIt impacts everyone who think there is any kind of authentication.ResolutionThis vulnerability has been fully fixed in server/v2.2.1 together with hydraidectl/v0.2.1.All users are strongly advised to upgrade:Update to hydraidectl v0.2.1Re-initialize server instances with hydraidectl init into a new folder. This generates the required certificate files, downloads the latest binaries, and sets up the necessary environment variables.For migration help, join the community Discord: https://discord.gg/xE2YSkzFRm or open a GitHub Discussion.
If anything does not work, please report it.
CVSS v3.1 score: 10
CVE-2023-33405 
Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.
CVSS v3.1 score: 6.1
CVE-2009-3781 
The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.
CVSS v2.0 score: 7.5
GHSA-g3ch-wcx8-mmq7 
In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: join hook list via splice_list_rcu() in commit phasePublish new hooks in the list into the basechain/flowtable using
splice_list_rcu() to ensure netlink dump list traversal via rcu is safe
while concurrent ruleset update is going on.
CVSS v3.1 score: 7.1
CVE-2026-25513 FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.
CVSS v4.0 score: 8.3
CVE-2018-13288 
Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtain sensitive information via the (1) folder_path or (2) real_path parameter.
CVSS v3.0 score: 5.3
GHSA-r299-wm7p-f3jq 
A vulnerability, which was classified as problematic, has been found in PHPGurukul Art Gallery Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/edit-art-medium-detail.php. The manipulation of the argument artmed leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 2
CVSS v3.1 score: 3.5
CVE-2004-0999 
zgv 5.5.3 allows remote attackers to cause a denial of service (application crash via segmentation fault) via crafted multiple-image (animated) GIF images.
CVSS v2.0 score: 2.6
GHSA-7m2g-57pq-h3xr 
An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return sensitive information in certain situations, including local file paths and SOCET GXP version information.
CVSS v3.1 score: 5.1
GHSA-g8pp-m4fh-wjg4 
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of Service when writing invalid memory blocks to the controller over Modbus.
GHSA-wr69-g62g-2r9h Improper Restriction of XML External Entity Reference in Apace Derby
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
CVSS v3.0 score: 9.1
GHSA-j35v-jw9h-2h3w 
Windows Kernel Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.3
GHSA-jq9g-rw6w-4vhv 
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
CVSS v3.0 score: 5.9
ICSA-17-150-01 Automated Logic Corporation ALC WebCTRL, Liebert SiteScan, Carrier i-VU
An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.CVE-2016-5795 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
CVSS v3.0 score: 6.5
CVE-2014-5269 
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.
CVSS v2.0 score: 5
GHSA-wr4w-95gx-6cfr 
socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.
CVSS v3.1 score: 7.8
CVE-2009-4223 
PHP remote file inclusion vulnerability in adm/krgourl.php in KR-Web 1.1b2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.
CVSS v2.0 score: 7.5
GHSA-hv4w-jhcj-6wfw Cross-Site Scripting in snekserve
All versions of `snekserve` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.RecommendationNo fix is currently available. Consider using an alternative package until a fix is made available.
CVE-2023-40426 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. An app may be able to bypass certain Privacy preferences.
CVSS v3.1 score: 5.5
GHSA-26cr-gfxr-8xq9 
Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
CVE-2005-4066 
Total Commander 6.53 uses weak encryption to store FTP usernames and passwords in WCX_FTP.INI, which allows local users to decrypt the passwords and gain access to FTP servers, as possibly demonstrated by the W32.Gudeb worm.
CVSS v2.0 score: 4.9
GHSA-6c7q-3hq7-hf68 
A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::AP4_ContainerAtom of the component mp4encrypt. The manipulation leads to memory leak. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212678 is the identifier assigned to this vulnerability.
CVSS v3.1 score: 6.5
GHSA-g8p5-fw36-3r3c 
The NIS+ rpc.nisd server allows remote attackers to execute certain RPC calls without authentication to obtain system information, disable logging, or modify caches.
CVE-2008-5627 
SQL injection vulnerability in account.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands via the (1) username parameter (aka Email field) or the (2) password parameter. NOTE: some of these details are obtained from third party information.
CVSS v2.0 score: 7.5
CVE-2017-17505 
In HDF5 1.10.1, there is a NULL pointer dereference in the function H5O_pline_decode in the H5Opline.c file in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
CVE-2019-16751 
An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects the fallback_render method in the omniauth callbacks controller.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2025-52777 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Reflected XSS.This issue affects Pay with Contact Form 7: from n/a through <= 1.0.4.
CVSS v3.1 score: 7.1
CVE-2021-0238 Junos OS: MX Series: Executing CLI command repetitively may cause the system to run out of disk space
When a MX Series is configured as a Broadband Network Gateway (BNG) based on Layer 2 Tunneling Protocol (L2TP), executing certain CLI command may cause the system to run out of disk space, excessive disk usage may cause other complications. An administrator can use the following CLI command to monitor the available disk space: user@device> show system storage Filesystem Size Used Avail Capacity Mounted on /dev/gpt/junos 19G 18G 147M 99% /.mount <<<<< running out of space tmpfs 21G 16K 21G 0% /.mount/tmp tmpfs 5.3G 1.7M 5.3G 0% /.mount/mfs This issue affects Juniper Networks Junos OS on MX Series: 17.3R1 and later versions prior to 17.4R3-S5, 18.1 versions prior to 18.1R3-S13, 18.2 versions prior to 18.2R3-S7; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R3-S7; 19.1 versions prior to 19.1R3-S4; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R1-S1, 20.4R2; This issue does not affect Juniper Networks Junos OS versions prior to 17.3R1.
CVSS v3.1 score: 5.5
GHSA-5p3h-545h-3hhq 
A security flaw has been discovered in macrozheng mall-swarm up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 4.3
GHSA-qpx8-xxq5-mg9r 
A denial of service vulnerability exists in Windows DNS Server when it fails to properly handle DNS queries, aka 'Windows DNS Server Denial of Service Vulnerability'.
CVSS v3.0 score: 7.5
CVE-2025-26859 
RemoteView PC Application Console versions prior to 6.0.2 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution.
CVSS v4.0 score: 8.5
CVSS v3.0 score: 7.8
GHSA-26hm-r6mg-963c SQL Injection in JeecgBoot
In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges. A patch has been released on the repository's `master` branch.
CVSS v3.1 score: 9.8
CVE-2026-6862 Efivar: efivar: denial of service due to stack overflow in device path node parsing
A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).
CVSS v3.1 score: 5.5
GHSA-wf98-vxv9-jqfv XSS Injection Vulnerability
ImpactUnder some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied.PatchesThis has been patched in Craft 3.7.29.Referenceshttps://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18For more informationIf you have any questions or comments about this advisory, email us at [support@craftcms.com](mailto:support@craftcms.com)Credits: https://github.com/noobpk
GHSA-35v5-5w5j-5cx2 
Development and test API endpoints are present that mirror production functionality.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
GHSA-mwcm-qxp3-wwj9 
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
CVSS v4.0 score: 4.1
GHSA-rw36-f5j3-hj4c 
The Alba Board plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to access arbitrary private alba_card post data, including title, description, assignee, due date, tags, and comments, that is intended to be restricted to Administrators and Editors. The handler is registered via the wp_ajax_nopriv_ hook and its nonce is exposed to all site visitors through wp_localize_script on pages containing the [alba_board] shortcode, making this exploitable by unauthenticated users who can access any such page.
CVSS v3.1 score: 4.3
GHSA-jj8q-gwh4-5vm4 
Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS v3.1 score: 7.8
CVE-2017-8248 
A buffer overflow may occur in the processing of a downlink NAS message in Qualcomm Telephony as used in Apple iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2021-1245 Cisco Finesse OpenSocial Gadget Editor Cross-Site Scripting Vulnerability
Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Finesse and Cisco Unified CVP could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS v3.1 score: 6.5
CVE-2017-5239 
Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle (MitM) listener.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2023-51613 D-Link DIR-X3260 prog.cgi SetDynamicDNSSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability
D-Link DIR-X3260 prog.cgi SetDynamicDNSSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21590.
CVSS v3.0 score: 6.8
GHSA-3v49-f236-jv89 
The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack
CVSS v3.1 score: 6.5
ICSA-23-173-02 Advantech R-SeeNet
Advantech R-SeeNet is installed with a hidden root-level user that is not available in the users list.  This hidden user has a password that cannot be changed by users. Advantech R-SeeNet allows low-level users to access and load the content of local files.
CVSS v3.0 score: 8.8
GHSA-qh3f-4fcx-3j98 
The cpdf_open function in the ClibPDF (cpdf) extension in PHP 4.4.6 allows context-dependent attackers to obtain sensitive information (script source code) via a long string in the second argument.
RHSA-2023:6402 Red Hat Security Advisory: containernetworking-plugins security and bug fix update
golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption golang: net/http, net/textproto: denial of service from excessive memory allocation golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption golang: html/template: backticks not treated as string delimiters golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of JavaScript whitespace golang: html/template: improper handling of empty HTML attributes golang: net/http: insufficient sanitization of Host header
CVSS v3.1 score: 6.5
CVE-2022-22997 Command Injection Vulnerability on My Cloud Home
Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.
CVSS v3.1 score: 6.8
CVE-2011-1436 
Google Chrome before 11.0.696.57 on Linux does not properly interact with the X Window System, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS v2.0 score: 5
GHSA-rq77-qpj3-hq3x 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer allows Blind SQL Injection. This issue affects MyStyle Custom Product Designer: from n/a through 3.21.1.
CVSS v3.1 score: 9.3
CVE-2025-6389 Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leveraged to inject backdoors or, for example, create new administrative user accounts.
CVSS v3.1 score: 9.8
CVE-2023-45698 HCL Sametime is impacted by clickjacking
Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks.

CVSS v3.1 score: 4.8
GHSA-rvwx-fgxf-5vwq 
CVE-2026-55400 is an integer underflow in Secure Access servers prior to
 version 14.57. Attackers with an authenticated session can send 
specially crafted traffic to a server in a non-default configuration and
 cause a persistent denial of service.
CVSS v4.0 score: 6
GHSA-5227-22f5-m93m 
HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability.  An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.
CVSS v3.1 score: 8.9
CVE-2025-39355 WordPress FAT Services Booking plugin <= 5.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking allows SQL Injection.This issue affects FAT Services Booking: from n/a through <= 5.6.
CVSS v3.1 score: 8.5
CVE-2025-66249 Apache Livy: Unauthorized directory access
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy.

This issue affects Apache Livy: from 0.3.0 before 0.9.0.

The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value "livy.file.local-dir-whitelist" is set to a non-default value, the directory checking can be bypassed.

Users are recommended to upgrade to version 0.9.0, which fixes the issue.
CVSS v3.1 score: 6.3
CVE-2006-0774 
SQL injection vulnerability in deleteSession() in DB_eSession library 1.0.2 and earlier, as used in multiple products, allows remote attackers to execute arbitrary SQL commands via the $_sess_id_set variable, which is usually derived from PHPSESSID.
CVSS v2.0 score: 7.5
GHSA-c296-66xh-547q 
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute limited actions on behalf of the victim user. User interaction is required.
CVSS v3.1 score: 5.4
GHSA-3vpc-63g5-hmgh 
The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request.
CVSS v3.0 score: 5.3
GHSA-gp7x-938x-q5x3 
SQL injection vulnerability in vBSupport.php in vSupport Integrated Ticket System 3.x.x allows remote attackers to execute arbitrary SQL commands via the ticketid parameter in a showticket action.
CVE-2022-35692 Adobe Commerce Improper Access Control Security feature bypass
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account detials. Exploitation of this issue does not require user interaction.
CVSS v3.1 score: 5.3
CVE-2022-32061 
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
CVSS v3.1 score: 4.8
CVSS v2.0 score: 3.5
GHSA-7245-97xv-qh8g 
Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges.
CVSS v3.0 score: 8.8
CVE-2002-0319 
Cross-site scripting vulnerability in edituser.php for pforum 1.14 and earlier allows remote attackers to execute script and steal cookies from other users via Javascript in a username.
CVSS v2.0 score: 7.5
CVE-2006-6965 
CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the media parameter.  NOTE: this issue can be leveraged for XSS attacks.
CVSS v2.0 score: 4.3
CVE-2018-11679 
An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&table=archive&admin_dir=admin.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
GHSA-vmj9-38jh-86gf 
Improper access control for some Intel(R) Graphics software may allow an authenticated user to potentially enable denial of service via local access.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
GHSA-v3v3-63mf-9ccx 
A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds write vulnerability which may result in code execution.
CVSS v3.1 score: 7.8
CVE-2025-21216 Internet Connection Sharing (ICS) Denial of Service Vulnerability
Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVSS v3.1 score: 6.5
CVE-2020-25234 
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The LOGO! program files generated and used by the affected components offer the possibility to save user-defined functions (UDF) in a password protected way. This protection is implemented in the software that displays the information. An attacker could reverse engineer the UDFs directly from stored program files.
CVSS v3.1 score: 7.7
CVSS v2.0 score: 3.6
GHSA-959q-39p3-w54w 
Buffer overflow in Adobe Reader and Acrobat 8.x before 8.3.1, 9.x before 9.4.6, and 10.x before 10.1.1 allows attackers to execute arbitrary code via unspecified vectors.
GHSA-w86x-6fw3-w2rf 
CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter.
CVE-2005-2701 
Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.
CVSS v2.0 score: 7.5
GHSA-w9vc-m3rh-pjp8 
In the Linux kernel, the following vulnerability has been resolved:phy: marvell: a3700-comphy: Fix out of bounds readThere is an out of bounds read access of 'gbe_phy_init_fix[fix_idx].addr'
every iteration after 'fix_idx' reaches 'ARRAY_SIZE(gbe_phy_init_fix)'.Make sure 'gbe_phy_init[addr]' is used when all elements of
'gbe_phy_init_fix' array are handled.Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS v3.1 score: 5.5
CVE-2026-0130 
In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS v3.1 score: 3.5