CIRCL/vulnerability-scores huggingface dataset:
GHSA-rxj6-jfgp-j36w 
Extremail 1.5.9 does not check passwords correctly when they are all digits or begin with a digit, which allows remote attackers to gain privileges.
GHSA-2795-pjw4-5495 
A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges.
CVSS v4.0 score: 8.5
CVE-2024-43849 soc: qcom: pdr: protect locator_addr with the main mutex
In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: pdr: protect locator_addr with the main mutex

If the service locator server is restarted fast enough, the PDR can
rewrite locator_addr fields concurrently. Protect them by placing
modification of those fields under the main pdr->lock.
CVSS v3.1 score: 5.5
GHSA-g72q-524q-phrp 
Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack.
CVSS v3.0 score: 3.7
GHSA-jm5r-x5jp-jq33 
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2018-6922 
One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p10 uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in the reassembly queue. An attacker who has the ability to send TCP traffic to a victim system can degrade the victim system's network performance and/or consume excessive CPU by exploiting the inefficiency of TCP reassembly handling, with relatively small bandwidth cost.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2009-2513 
The Graphics Device Interface (GDI) in win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Insufficient Data Validation Vulnerability."
CVSS v2.0 score: 7.2
GHSA-vx86-wgxh-78rp 
Multiple cross-site scripting (XSS) vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) FILE, or (3) DOMAIN parameters.
CVE-2007-4639 
EnterpriseDB Advanced Server 8.2 does not properly handle certain debugging function calls that occur before a call to pldbg_create_listener, which allows remote authenticated users to cause a denial of service (daemon crash) and possibly execute arbitrary code via a SELECT statement that invokes a pldbg_ function, as demonstrated by (1) pldbg_get_stack and (2) pldbg_abort_target, which triggers use of an uninitialized pointer.
CVSS v2.0 score: 6.5
CVE-2020-15112 Improper Input Validation in etcd
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
CVSS v3.1 score: 6.5
RHSA-2022:7384 Red Hat Security Advisory: openssl-container security update
OpenSSL: X.509 Email Address Buffer Overflow OpenSSL: X.509 Email Address Variable Length Buffer Overflow
CVSS v3.1 score: 7.5
GHSA-8j42-w4ff-mq7x 
There is a local denial of service vulnerability in the Antiy Zhijia Terminal Defense System 5.0.2.10121559 and an attacker can cause a computer crash (BSOD).
GHSA-4hrq-xfjw-8g7p 
An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet.
CVSS v3.1 score: 7.5
CVE-2023-40332 WordPress WP-PostRatings plugin <= 1.91 - Rating limit Bypass vulnerability
Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.
CVSS v3.1 score: 5.3
CVE-2008-2066 
Cross-site scripting (XSS) vulnerability in bb_admin.php in miniBB 2.2a allows remote attackers to inject arbitrary web script or HTML via the whatus parameter in a searchusers2 action.  NOTE: it was later reported that other versions before 3.0.1 are also vulnerable.
CVSS v2.0 score: 4.3
CVE-2020-1202 
An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fail to properly handle objects in memory, aka 'Diagnostic Hub Standard Collector Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1203.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 7.2
CVE-2020-10730 
A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
GHSA-6r6p-vqvg-rv66 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Contact Form Widget.This issue affects Contact Form Widget: from n/a through 1.3.9.
CVSS v3.1 score: 5.3
GHSA-486g-jg8g-q4pg 
Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
GHSA-rq9g-h4j2-r538 
Multiple buffer overflows in Imagemagick 6.0 before 6.0.6.2, and 6.2 before 6.2.4.5, has unknown impact and user-assisted attack vectors via a crafted SGI image.
GHSA-x73g-5x4f-9mqr 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.
CVSS v3.1 score: 9.9
CVE-2002-1691 
Alcatel OmniPCX 4400 installs known user accounts and passwords in the /etc/password file by default, which allows remote attackers to gain unauthorized access.
CVSS v2.0 score: 10
CVE-2014-5275 
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) password, (2) email, or (3) id parameter.
CVSS v2.0 score: 6.5
CVE-2018-4404 
In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling.
CVSS v3.1 score: 8.8
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
CVE-2002-1238 
Peter Sandvik's Simple Web Server 0.5.1 and earlier allows remote attackers to bypass access restrictions for files via an HTTP request with a sequence of multiple / (slash) characters such as http://www.example.com///file/.
CVSS v2.0 score: 7.5
GHSA-h7vf-2gmx-cr9w 
The Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
RHSA-2018:1700 Red Hat Security Advisory: procps-ng security update
procps: Integer overflows leading to heap overflow in file2strvec procps: incorrect integer size in proc/alloc.* leading to truncation / integer overflow issues
CVSS v3.0 score: 4.8
GHSA-g3v5-x7p8-gp6p 
Cross-site scripting (XSS) vulnerability in default/login.php in EditeurScripts EsBaseAdmin 2.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037.
CVE-2026-10894 
Use after free in Printing in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVSS v3.1 score: 8.3
PYSEC-2026-1536 
py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.
CVSS v3.1 score: 4.3
CVE-2009-5077 
CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHP_SELF variable, which is not properly handled by (1) includes/application_top.php and (2) admin/includes/application_top.php.
CVSS v2.0 score: 7.5
CVE-2024-21219 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and  9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 4.9
GHSA-r6vr-q24x-m5gp 
TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times.
CVSS v3.0 score: 7.5
CVE-2018-15383 Cisco Adaptive Security Appliance Direct Memory Access Denial of Service Vulnerability
A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the affected devices have a limited amount of Direct Memory Access (DMA) memory and the affected software improperly handles resources in low-memory conditions. An attacker could exploit this vulnerability by sending a sustained, high rate of malicious traffic to an affected device to exhaust memory on the device. A successful exploit could allow the attacker to exhaust DMA memory on the affected device, which could cause the device to reload and result in a temporary DoS condition.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 7.8
CVE-2025-13307 Ocean Modal Window < 2.3.3 - Editor+ Remote Code Execution via Modal Conditions
The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be displayed under user-controlled conditions that Editors and Administrators can set (edit_pages capability). The conditions are then executed as part of an eval statement executed on every site page. This leads to remote code execution.
CVSS v3.1 score: 7.2
GHSA-48qw-x3w8-j666 
Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.
CVSS v3.1 score: 8.5
GHSA-78hr-8953-5gh6 
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.
CVSS v3.0 score: 8.8
GHSA-q8f9-449c-rf6m 
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose. Using this, attackers could access internal services used by Ruijie and their internal cloud infrastructure via AWS cloud metadata services.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
cisco-sa-snort3-dcerpc-vulns-J9HNF4tH Multiple Cisco Products Snort 3 Distributed Computing Environment/Remote Procedure Call Vulnerabilities
Multiple Cisco products are affected by vulnerabilities in the processing of Distributed Computing Environment Remote Procedure Call (DCE/RPC) requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, which would result in an interruption of packet inspection.

For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.

Cisco has released software updates that address these vulnerabilities. There are workarounds that address these vulnerabilities.


CVSS v3.1 score: 5.3
GHSA-552g-3pcr-rj34 
A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to cause unexpected system termination.
CVSS v3.1 score: 5.1
CVE-2023-54132 erofs: stop parsing non-compact HEAD index if clusterofs is invalid
In the Linux kernel, the following vulnerability has been resolved:

erofs: stop parsing non-compact HEAD index if clusterofs is invalid

Syzbot generated a crafted image [1] with a non-compact HEAD index of
clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1,
which causes the following unexpected behavior as below:

 BUG: unable to handle page fault for address: fffff52101a3fff9
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 23ffed067 P4D 23ffed067 PUD 0
 Oops: 0000 [#1] PREEMPT SMP KASAN
 CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0
 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
 Workqueue: erofs_worker z_erofs_decompressqueue_work
 RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40
 ...
 Call Trace:
  <TASK>
  z_erofs_decompressqueue_work+0x99/0xe0
  process_one_work+0x8f6/0x1170
  worker_thread+0xa63/0x1210
  kthread+0x270/0x300
  ret_from_fork+0x1f/0x30

Note that normal images or images using compact indexes are not
impacted.  Let's fix this now.

[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com
CVSS v3.1 score: 7.8
GHSA-wrw9-9v8g-q8cv 
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
GHSA-pxhx-2v5w-x5mg 
Multiple SQL injection vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the year parameter to (1) view.page.inc.php, which is reachable through a view action to index.php; or (2) the year parameter to news.page.inc.php, which is reachable through a news action to index.php.
GHSA-hf7c-m9qj-7hvq 
The Error Log Viewer WordPress plugin through 1.1.1 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server.
CVSS v3.1 score: 6.5
GHSA-cjp9-h6x7-98p3 
An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first or all transactions with the same reference are completed, depending on timing. This can be used to transfer more money onto employee cards than is paid.
CVSS v3.1 score: 7.5
GHSA-wvmj-jgmg-4ghq 
An SNMP community name is the default (e.g. public), null, or missing.
CVSS v3.1 score: 5.9
GHSA-744h-wr4m-3wwg 
Cross-Site Request Forgery (CSRF) vulnerability in RedNao Donations Made Easy – Smart Donations.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.
CVSS v3.1 score: 5.4
GHSA-g2jv-pgqw-qxhv 
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 7.1
GHSA-v2cq-8xv3-3vq4 
A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.
CVSS v3.1 score: 7.5
GHSA-8865-824r-j6c9 
IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 203168.
CVE-2025-7480 PHPGurukul Vehicle Parking Management System signup.php sql injection
A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this issue is some unknown functionality of the file /users/signup.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-cgvm-cjwc-rjg3 
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
CVE-2021-41449 
A path traversal attack in web interfaces of Netgear RAX35, RAX38, and RAX40 routers before v1.0.4.102, allows a remote unauthenticated attacker to gain access to sensitive restricted information, such as forbidden files of the web application, via sending a specially crafted HTTP packet.
CVSS v3.1 score: 7.1
CVSS v2.0 score: 3.6
GHSA-3jqf-v4mv-747g Moonraker affected by LDAP search filter injection
ImpactInstances of Moonraker configured with the `ldap` component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint.   The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes.PatchesUsers should upgrade to Moonraker 0.10.0 which patches this vulnerability.WorkaroundsAdmins can set the `max_login_attempts` option in the `[authorization]` section to a reasonable value.    Any IP attempting to exploit this vulnerability will be locked out after it has reached the specified number of consecutive failed login attempts.  This condition is cleared after a Moonraker restart.   Note that if an attacker knows a valid user password they can bypass this protection by successfully logging in.The most secure workaround for users unable to upgrade is to remove the `ldap` section from `moonraker.conf` and rely on the built in user authentication.
CVSS v4.0 score: 2.7
RHSA-2015:1457 Red Hat Security Advisory: gnutls security and bug fix update
gnutls: gnutls does not perform date/time checks on CA certificates gnutls: RSA PKCS#1 signature verification forgery gnutls: certificate algorithm consistency checking issue
CVE-2025-22572 WordPress Legacy ePlayer plugin <= 0.9.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Legacy ePlayer sportspress-tv allows Stored XSS.This issue affects Legacy ePlayer: from n/a through <= 0.9.9.
CVSS v3.1 score: 6.5
CVE-2019-1338 
A security feature bypass vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLMv2 protection if a client is also sending LMv2 responses, aka 'Windows NTLM Security Feature Bypass Vulnerability'.
CVSS v3.1 score: 5.9
CVSS v2.0 score: 4.3
CVE-2014-3488 
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
CVSS v2.0 score: 5
CVE-2019-15836 
The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
RHSA-2013:0957 Red Hat Security Advisory: java-1.7.0-openjdk security update
OpenJDK: Insecure shared memory permissions (2D, 8001034) OpenJDK: Frame injection in generated HTML (Javadoc, 8012375) OpenJDK: Integrate Apache Santuario, rework class loader (Libraries, 6741606, 8008744) OpenJDK: JConsole SSL support (Serviceability, 8003703) OpenJDK: AccessControlContext check order issue (Libraries, 8001330) OpenJDK: Resource denial of service (AWT, 8001038) OpenJDK: Better handling of memory allocation errors (Hotspot, 7158805) OpenJDK: output stream access restrictions (CORBA, 8000642) OpenJDK: Prevent revealing the local address (Networking, 8001318) OpenJDK: Better access restrictions (Sound, 8006328) OpenJDK: GnomeFileTypeDetector path access check (Libraries, 8004288) OpenJDK: ObjectStreamClass circular reference denial of service (Serialization, 8000638) OpenJDK: Unique VMIDs (Libraries, 8001033) OpenJDK: MBeanServer Introspector package access (JMX, 8008124) OpenJDK: SerialJavaObject package restriction (JDBC, 8009554) OpenJDK: getEnclosing* checks (Libraries, 8007812) OpenJDK: ObjectOutputStream access checks (Serialization, 8008132) OpenJDK: Proper class checking (JMX, 8008120) OpenJDK: Method handles (Libraries, 8009424) OpenJDK: Various AWT integer overflow checks (AWT, 8009071) OpenJDK: tracing insufficient access checks (Serviceability, 8010209) OpenJDK: Missing check for valid DOMCanonicalizationMethod canonicalization algorithm (Libraries, 8014281) OpenJDK: Incorrect image attribute verification (2D, 8012438) OpenJDK: Incorrect image channel verification (2D, 8012597) OpenJDK: Incorrect image layout verification (2D, 8012601) OpenJDK: ImagingLib byte lookup processing (2D, 8011243) OpenJDK: Incorrect IntegerComponentRaster size checks (2D, 8011248) OpenJDK: Incorrect ShortBandedRaster size checks (2D, 8011253) OpenJDK: Incorrect ByteBandedRaster size checks (2D, 8011257)
GHSA-635m-xjgg-38mc 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VanKarWai Calafate calafate allows PHP Local File Inclusion.This issue affects Calafate: from n/a through <= 1.7.7.
CVSS v3.1 score: 7.5
GHSA-wqpx-vj4r-cjvj 
Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2007-1701 
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:".
CVSS v2.0 score: 6.8
CVE-2024-41577 
An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CVSS v3.1 score: 9.8
GHSA-jgmj-x9w7-75p7 
UDP messages to broadcast addresses are allowed, allowing for a Fraggle attack that can cause a denial of service by flooding the target.
GHSA-7pwc-85mf-qvrm 
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
GHSA-3h94-x92g-h9g5 
Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).
CVSS v4.0 score: 8.6
CVSS v3.1 score: 8.1
RHSA-2026:0020 Red Hat Security Advisory: thunderbird security update
firefox: thunderbird: Use-after-free in the WebRTC: Signaling component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thunderbird: Privilege escalation in the DOM: Notifications component firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component firefox: thunderbird: Privilege escalation in the Netmonitor component firefox: thunderbird: Privilege escalation in the Netmonitor component firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component firefox: thunderbird: Same-origin policy bypass in the Request Handling component firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146
CVSS v3.1 score: 6.1
GHSA-5gq3-mh83-6m28 
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
CVSS v3.1 score: 9.8
GHSA-54x2-3gfp-xm8f 
The Nouri.sh Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 1.0.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1 score: 6.1
GHSA-6mg9-j83c-v67x 
Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to webmin. IBM X-Force ID: 103921.
CVSS v3.0 score: 8.8
GHSA-fj2x-735w-74vq gnark-crypto allows unchecked memory allocation during vector deserialization
The issue has been reported by @raefko from @fuzzinglabs. Excerpts from the report:A critical vulnerability exists in the gnark-crypto library's `Vector.ReadFrom()` function that allows an attacker to trigger arbitrary memory allocation by crafting malicious input data. An attacker can cause the verifier to attempt allocating up to 128 GB of memory with a minimal malicious input, leading to out-of-memory crashes and denial of service.**Root Cause**The vulnerability stems from **unchecked deserialization** of attacker-controlled length fields in the gnark-crypto library's `Vector.ReadFrom()` function. The function reads a 4-byte unsigned integer from untrusted input and directly uses it to allocate memory without any validation or bounds checking.**Vulnerable Code Path****Vulnerable Code****File**: [`gnark-crypto@v0.14.0+/ecc/bn254/fr/vector.go:136-144`](https://github.com/Consensys/gnark-crypto/blob/8310aae2de6104d3fe3610e3370b2bed10c63111/ecc/bn254/fr/vector.go#L136)The code reads a 4-byte big-endian unsigned integer (`sliceLen`) directly from the input stream and uses it to allocate a slice without any bounds checking or validation. Each element is 32 bytes (fr.Element for BN254 curve), so an attacker can request up to:**Maximum Allocation**: `2^32 elements × 32 bytes = 137,438,953,472 bytes ≈ 128 GB`**Root Cause Analysis**The gnark-crypto library implements a generic serialization format for field element vectors. The format is:The deserialization code **trusts** the length field implicitly without any validation. This is a classic **integer-to-allocation vulnerability** pattern, similar to issues that have affected many serialization libraries over the years.ImpactThe issue impacts users deserializing vectors directly from untrusted sources. In case of malicious input it would lead to OOM in case the server doesn't have sufficient memory (depending on the field, but could allocate from 32GB to 196GB).PatchesThe issue is patched in https://github.com/Consensys/gnark-crypto/pull/759. It will be backported to gnark-crypto v0.18 and v0.19.WorkaroundsThe user could manually peek into the first 4 bytes of the serialized data to estimate if the header would allocate large amounts of memory.
CVSS v3.1 score: 7.5
CVE-2025-2051 PHPGurukul Apartment Visitors Management System search-visitor.php sql injection
A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /search-visitor.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-hf8r-4jg5-gcvm 
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
CVE-2014-0272 
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2.0 score: 9.3
CVE-2018-0711 
Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
CVE-2019-19958 
In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an integer signedness issue that could lead to an attempted excessive memory allocation and denial of service.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
CVE-2017-9964 
A Path Traversal issue was discovered in Schneider Electric Pelco VideoXpert Enterprise all versions prior to 2.1. By sniffing communications, an unauthorized person can execute a directory traversal attack resulting in authentication bypass or session hijack.
CVSS v3.0 score: 6.9
CVSS v2.0 score: 5.8
GHSA-9px2-pxx2-vq3x 
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues
CVE-2014-9932 
In TrustZone, an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel due to an improper address range computation.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
GHSA-w97x-4945-cvr5 
A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument qos can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
CVSS v4.0 score: 7.4
CVSS v3.1 score: 8.8
CVE-2019-5674 
NVIDIA GeForce Experience before 3.18 contains a vulnerability when ShadowPlay or GameStream is enabled. When an attacker has access to the system and creates a hard link, the software does not check for hard link attacks. This behavior may lead to code execution, denial of service, or escalation of privileges.
CVSS v3.0 score: 7
CVSS v2.0 score: 6.9
CVE-2021-36301 
Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploit this vulnerability to control process execution and gain access to the underlying operating system.
CVSS v3.1 score: 5.9
GHSA-3r9x-86qj-c5f2 
PHP remote file inclusion vulnerability in admin.treeg.php in the Flash Tree Gallery (com_treeg) component 1.0 for Joomla!, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfig_live_site parameter.
GHSA-ff6r-62wv-fr5p 
Windows Graphics Component Remote Code Execution Vulnerability.
CVSS v3.1 score: 8.8
CVE-2024-27575 
INOTEC Sicherheitstechnik WebServer CPS220/64 3.3.19 allows a remote attacker to read arbitrary files via absolute path traversal, such as with the /cgi-bin/display?file=/etc/passwd URI.
CVSS v3.1 score: 7.5
GHSA-8x8q-89w8-f24c 
An issue in the native clients for Amazon WorkSpaces Clients when running PCoIP protocol may allow an attacker to access remote sessions via man-in-the-middle.
CVSS v4.0 score: 7.7
CVSS v3.1 score: 7.5
RHSA-2024:8504 Red Hat Security Advisory: python39:3.9 security update
python: cpython: tarfile: ReDos via excessive backtracking while parsing header values
CVSS v3.1 score: 7.5
CVE-2023-44482 Leave Management System Project v1.0 - Multiple Authenticated SQL Injections (SQLi)
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS v3.1 score: 8.8
CVE-2021-46394 
There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v13 variable is directly retrieved from the http request parameter startIp. Then v13 will be splice to stack by function sscanf without any security check, which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-59rv-395v-g9xw 
A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects some unknown processing of the file index.php?page=site_settings of the component Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221591.
CVSS v3.1 score: 8.8
CVE-2007-5694 
Absolute path traversal vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to read arbitrary files via an absolute path in the dir parameter, a different vulnerability than CVE-2007-5491.
CVSS v2.0 score: 6.8
CVE-2021-30521 
Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
GHSA-5v3j-6p4g-6p7m 
A stored cross-site scripting (XSS) vulnerability in the /manage/loginusername component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username field.
CVE-2021-25352 
Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijacking and modifying the intent.
CVSS v3.1 score: 5.5
GHSA-7wh2-wxc7-9ph5 WiX Toolset's .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges
Summary.be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges.DetailsIf the bundle is not run as admin, the user's TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user's TEMP folder for changes and drop its own DLL into the **.be/<bundle>.Local** folder immediately when the .be folder is created. When the burn engine elevates, the malicious DLL receives elevated privileges.PoCAs a standard, non-admin user:Monitor the user's TEMP folder for changes using ReadDirectoryChangesWOn FILE_ACTION_ADDED, check if the folder name is .beCreate a folder in .be named after the bundle + .Local (e.g. MyInstaller.exe.Local)Put the malicious COMCTL32.DLL in the .Local folder following the naming used for the real DLL (e.g. MyInstaller.exe.Local/x86_microsoft.windows.common-controls_.../COMCTL32.dll)Do hacker things when the engine escalates and the malicious DLL is loadedProper naming for the path can be obtained by using GetModuleHandle("comctl32.dll") and GetModuleFileName.ImpactDLL redirection utilizing .exe.Local Windows capability. This impacts any installer built with the WiX installer framework.
CVSS v3.1 score: 8.2
CVE-2024-49837 Improper Validation of Array Index in Automotive OS Platform
Memory corruption while reading CPU state data during guest VM suspend.
CVSS v3.1 score: 7.8
CVE-2026-12383 Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn
A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions.
CVSS v3.1 score: 7.5
GHSA-2ww6-hf35-mfjm Capsule Namespace Hijacking via subresource
SummaryTo defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a namespace, including the metadata field. The webhook does not define interception rules for these subresources. As a result, if a tenant administrator has permission to modify namespace/status or namespace/finalize, they can successfully perform namespace hijacking.DetailsWhen Capsule uses a ValidatingWebhookConfiguration to intercept changes to namespace resources, it does not intercept modification requests initiated through namespace subresource APIs (see: https://github.com/projectcapsule/capsule/blob/main/charts/capsule/templates/validatingwebhookconfiguration.yaml#L193). Through subresource APIs, it is still possible to modify the metadata field of a namespace resource, enabling hijacking.PoCOpen two terminals and create two tenants:When the attacker has permission to modify namespace/status or namespace/finalize, they can hijack other namespaces. Here we grant the attacker the relevant permissions:The attacker then sends a PATCH request to namespace/status to hijack the namespace created by alice:Impacthijack namespaceRemediationTo mitigate this issue, add the following two subresources to the resources list in the ValidatingWebhookConfiguration rules:
CVSS v3.1 score: 3.9
GHSA-qgw2-v7vq-9g5r 
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
CVSS v3.1 score: 6.8
CVE-2023-1132 Key duplication in GSDK

Compiler removal of buffer clearing in 

sli_se_driver_key_agreement

 in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


CVSS v3.1 score: 5.3
CVE-2024-49248 WordPress Ad Inserter plugin <= 2.7.37 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through <= 2.7.37.
CVSS v3.1 score: 7.1
GHSA-9wmj-55r5-f45x 
Product: AndroidVersions: Android kernelAndroid ID: A-215565667References: N/A
CVSS v3.1 score: 9.8
CVE-2012-5352 
Java Open Single Sign-On Project Home (JOSSO) allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."
CVSS v2.0 score: 5.8
CVE-2026-44060 Integer underflow in dsi_writeinit() leads to denial of service
An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.
CVSS v3.1 score: 7.5
GHSA-4842-39rx-hq8h 
Cross-site scripting (XSS) vulnerability in index.php in SimpleGallery 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the album parameter.
CVE-2024-10386 Rockwell Automation FactoryTalk ThinManager Authentication Vulnerability
CVE-2024-10386 IMPACT



An authentication
vulnerability exists in the affected product. The vulnerability could allow a
threat actor with network access to send crafted messages to the device, potentially
resulting in database manipulation.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
GHSA-h3r5-4h6r-gcwc 
download.php in the MuddyDogPaws FileDownload snippet before 2.5 for MODx allows remote attackers to download arbitrary files, as demonstrated by downloading config.inc.php to obtain database credentials.
GHSA-q5x6-6wr4-r66h 
sendmsg function in NetBSD 1.3 through 1.5 allows local users to cause a denial of service (kernel trap or panic) via a msghdr structure with a large msg_controllen length.
GHSA-qrj3-fx9c-4m4x 
A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir parameters in tce_filemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim's session or performing actions on their behalf.
GHSA-p623-gg4q-6fv7 
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument lang leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS v4.0 score: 8.9
CVSS v3.1 score: 9.8
GHSA-xh4c-c9p9-cjx3 
SQL injection vulnerability in products.php in CommodityRentals Trade Manager Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVE-2025-41664 Improper Permission Handling Enables Unauthorized Access to Firmware and Certificates
A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e.g., FTP/SFTP). This access could allow the attacker to escalate privileges and modify firmware.
CVSS v3.1 score: 7.5
GHSA-r7m8-874r-4g5v 
Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.
CVSS v3.1 score: 7.7
GHSA-h829-hv72-h5f7 
Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
CVE-2024-7743 wanglongcn ltcms API Endpoint downloadUrl server-side request forgery
A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downloadUrl of the file /api/file/downloadUrl of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
CVE-2024-57545 
Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (hidden_dhcp_num) is copied to the stack without length verification.
CVSS v3.1 score: 5.5
GHSA-h79m-47pc-f28h 
code/display.php in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allows remote attackers to conduct directory traversal attacks and overwrite arbitrary files via a "....//" (dot dot) in the s parameter, which is collapsed into a "../" value.
RHSA-2002:151 Red Hat Security Advisory: : Updated libpng packages fix buffer overflow
security flaw security flaw
CVE-2025-58902 WordPress Lighthouse theme <= 1.2.12 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.
CVSS v3.1 score: 8.1
GHSA-m5w5-3qrh-4g39 
Directory traversal vulnerability in vote.cgi for Mike Spice Mike's Vote CGI before 1.3 allows remote attackers to write arbitrary files via .. (dot dot) sequences in the type parameter.
CVE-2020-16978 Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability
<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.</p>
<p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p>
<p>The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.</p>
CVSS v3.1 score: 5.4
GHSA-rfvc-9gpm-pcp3 
gdbus setgid privilege escalation
CVSS v3.1 score: 3.1
GHSA-fj2f-9p45-mvjp 
NETGEAR RAX30 Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.The specific flaw exists within the system configuration. The system contains a hardcoded user account which can be used to access the CLI service as a low-privileged user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19660.
CVSS v3.0 score: 6.3
GHSA-x4xg-c2mg-399g 
The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name_generator' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-99qp-9hmr-6jgh 
Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3.
CVSS v3.0 score: 8
CVE-2019-11706 
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affects Thunderbird < 60.7.1.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2025-63095 
Improper input validation in the BitstreamWriter::write_bits() function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS v3.1 score: 6.5
CVE-2002-1358 
Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.
CVSS v2.0 score: 10
GHSA-vcc8-pv5w-mvqj 
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call.