CIRCL/vulnerability-scores huggingface dataset:
GHSA-49vx-8hjm-wgxw 
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
CVSS v3.0 score: 9.8
RHSA-2024:1372 Red Hat Security Advisory: redhat-ds:11 security, bug fix, and enhancement update
389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)
CVSS v3.1 score: 5.5
CVE-2010-1300 
SQL injection vulnerability in index.php in Yamamah (aka Dove Photo Album) 1.00 allows remote attackers to execute arbitrary SQL commands via the calbums parameter.
CVSS v2.0 score: 7.5
CVE-2025-64793 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
GHSA-q6cc-xcc2-559m 
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4.
CVE-2026-49414 ASLR bypass for setuid executables via procctl(2)
The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before.  As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen.

An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2).  This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.
CVSS v3.1 score: 7.8
GHSA-wfjj-3hq8-qwp2 
An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.
CVSS v3.1 score: 6.5
CVE-2026-10015 
Integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
GHSA-8fjh-j2gv-59p9 
Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
CVSS v3.1 score: 7.8
CVE-2022-4503 Cross-site Scripting (XSS) - Generic in openemr/openemr
Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.0.2.
CVSS v3.0 score: 6.4
CVE-2020-27211 
Nordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against physical side channels. The flash read-out protection (APPROTECT) can be bypassed by injecting a fault during the boot phase.
CVSS v3.1 score: 5.7
CVSS v2.0 score: 3.3
CVE-2015-5867 
IOHIDFamily in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v2.0 score: 9.3
GHSA-7vw2-cghq-q23f 
lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV.
GHSA-25x7-27vj-3vw7 
WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
GHSA-q9cr-x7gx-g326 
BookReview beta 1.0 allows remote attackers to obtain the path of the web server via certain parameters to search.htm, possibly due to a search[string] parameter with a missing value or an incorrect submit[type] value, which reveals the path in the resulting error message.  NOTE: it is not clear whether BookReview is available to the public.  If not, then it should not be included in CVE.
CVE-2015-3736 
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVSS v2.0 score: 6.8
CVE-2024-43953 WordPress Classic Addons – WPBakery Page Builder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows Stored XSS.This issue affects Classic Addons – WPBakery Page Builder: from n/a through <= 3.5.
CVSS v3.1 score: 6.5
GHSA-qjmh-gf3w-643f 
An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.
CVSS v3.1 score: 7.8
CVE-2022-3215 
NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some form. A malicious user can add newlines to their input (usually in encoded form) and "inject" those newlines into the returned HTTP response. This capability allows users to work around security headers and HTTP/1.1 framing headers by injecting entirely false responses or other new headers. The injected false responses may also be treated as the response to subsequent requests, which can lead to XSS, cache poisoning, and a number of other flaws. This issue was resolved by adding validation to the HTTPHeaders type, ensuring that there's no whitespace incorrectly present in the HTTP headers provided by users. As the existing API surface is non-failable, all invalid characters are replaced by linear whitespace.
CVSS v3.1 score: 7.5
GHSA-4gfg-qwj4-89qg 
SQL injection vulnerability in question.php in FAQEngine 4.16.03 and earlier allows remote attackers to execute arbitrary SQL commands via the questionref parameter in a display action.
CVE-2014-8914 
Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8913.
CVSS v2.0 score: 3.5
CVE-2010-0553 
Geo++ GNCASTER 1.4.0.7 and earlier allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long NMEA data sentence.
CVSS v2.0 score: 6.5
GHSA-v2jf-wqm3-34g8 
Unspecified vulnerability in the Embedded Lights Out Manager (ELOM) on the Sun Fire X2100 M2 and X2200 M2 x86 platforms before SP/BMC firmware 3.20 allows remote attackers to obtain privileged ELOM login access or execute arbitrary Service Processor (SP) commands via unknown vectors, aka Bug ID 6648082, a different vulnerability than CVE-2007-5717.
GHSA-9998-pmcc-vpg5 
ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, which allows local users to obtain sensitive key information via the ptrace system call.
CVSS v3.1 score: 5.5
GHSA-jf86-639r-gxrp 
Denial of service in telnet from the Windows NT Resource Kit, by opening then immediately closing a connection.
GHSA-phh2-j3h6-vqr9 
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.
CVSS v3.1 score: 4.5
CVE-2023-5194 A system/user manager can demote / deactivate another manager
Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager


CVSS v3.1 score: 2.7
CVE-2024-43855 md: fix deadlock between mddev_suspend and flush bio
In the Linux kernel, the following vulnerability has been resolved:

md: fix deadlock between mddev_suspend and flush bio

Deadlock occurs when mddev is being suspended while some flush bio is in
progress. It is a complex issue.

T1. the first flush is at the ending stage, it clears 'mddev->flush_bio'
    and tries to submit data, but is blocked because mddev is suspended
    by T4.
T2. the second flush sets 'mddev->flush_bio', and attempts to queue
    md_submit_flush_data(), which is already running (T1) and won't
    execute again if on the same CPU as T1.
T3. the third flush inc active_io and tries to flush, but is blocked because
    'mddev->flush_bio' is not NULL (set by T2).
T4. mddev_suspend() is called and waits for active_io dec to 0 which is inc
    by T3.

  T1		T2		T3		T4
  (flush 1)	(flush 2)	(third 3)	(suspend)
  md_submit_flush_data
   mddev->flush_bio = NULL;
   .
   .	 	md_flush_request
   .	  	 mddev->flush_bio = bio
   .	  	 queue submit_flushes
   .		 .
   .		 .		md_handle_request
   .		 .		 active_io + 1
   .		 .		 md_flush_request
   .		 .		  wait !mddev->flush_bio
   .		 .
   .		 .				mddev_suspend
   .		 .				 wait !active_io
   .		 .
   .		 submit_flushes
   .		 queue_work md_submit_flush_data
   .		 //md_submit_flush_data is already running (T1)
   .
   md_handle_request
    wait resume

The root issue is non-atomic inc/dec of active_io during flush process.
active_io is dec before md_submit_flush_data is queued, and inc soon
after md_submit_flush_data() run.
  md_flush_request
    active_io + 1
    submit_flushes
      active_io - 1
      md_submit_flush_data
        md_handle_request
        active_io + 1
          make_request
        active_io - 1

If active_io is dec after md_handle_request() instead of within
submit_flushes(), make_request() can be called directly intead of
md_handle_request() in md_submit_flush_data(), and active_io will
only inc and dec once in the whole flush process. Deadlock will be
fixed.

Additionally, the only difference between fixing the issue and before is
that there is no return error handling of make_request(). But after
previous patch cleaned md_write_start(), make_requst() only return error
in raid5_make_request() by dm-raid, see commit 41425f96d7aa ("dm-raid456,
md/raid456: fix a deadlock for dm-raid456 while io concurrent with
reshape)". Since dm always splits data and flush operation into two
separate io, io size of flush submitted by dm always is 0, make_request()
will not be called in md_submit_flush_data(). To prevent future
modifications from introducing issues, add WARN_ON to ensure
make_request() no error is returned in this context.
CVSS v3.1 score: 5.5
CVE-2010-5154 
Race condition in BitDefender Total Security 2010 13.0.20.347 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute
CVSS v2.0 score: 6.2
CVE-2016-3664 
Trend Micro Mobile Security for iOS before 3.2.1188 does not verify the X.509 certificate of the mobile application login server, which allows man-in-the-middle attackers to spoof this server and obtain sensitive information via a crafted certificate.
CVSS v3.0 score: 7.4
CVSS v2.0 score: 5.8
CVE-2024-4301 N-Reporter and N-Cloud from N-Partner - Os Command Injection
N-Reporter and N-Cloud, products of the N-Partner, have an OS Command Injection vulnerability. Remote attackers with normal user privilege can execute arbitrary system commands by manipulating user inputs on a specific page.
CVSS v3.1 score: 8.8
GHSA-mqc6-qfm4-6pwr 
epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the lack of an EAPOL_RSN_KEY, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVSS v3.0 score: 5.9
GHSA-qx38-8ffc-m542 
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS v3.1 score: 8.8
ICSA-21-294-03 ICONICS GENESIS64 and Mitsubishi Electric MC Works64 OPC UA
The affected products are vulnerable to an uncontrollable recursion, which may trigger a stack-based buffer overflow.CVE-2021-27432 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.0 score: 7.5
CVE-2015-5490 
The _views_fetch_data method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors.
CVSS v2.0 score: 5
cisco-sa-ipphone-csrf-HOCmXW2c Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based management interface of an affected system.

This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform a factory reset of the affected device, resulting in a Denial of Service (DoS) condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.1 score: 6.5
CVE-2023-4740 IBOS OA Delete Draft delDraft&archiveId=0 sql injection
A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the component Delete Draft Handler. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238629 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2020-12848 
In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password and proceed to login to the web application. Once logged into the web application with the hidden user account, some actions that were not available with the public share link can now be performed.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 5.8
GHSA-hw29-pcpv-9423 
In the Linux kernel, the following vulnerability has been resolved:fs/proc/task_mmu: do not warn on seeing non-migration pmd entryPatch series "mm/hmm: A fix and a selftest", v3.Patch 1 fixes a stale warning present from the time when only migration
softleaf entries were supported at the PMD level.Patch 2 adds some code into hmm-tests.c which exercises the pagemap path
for PMD device-private entries.This patch (of 2):pagemap_pmd_range_thp() warns if a non-present PMD is not a migration
entry.  This became false once device-private entries at the PMD level
were added.Therefore, remove the stale migration-only assertion.
CVE-2025-9553 API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103
Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*.
CVSS v3.1 score: 5.3
GHSA-qg8q-9c83-3485 
In the Linux kernel, the following vulnerability has been resolved:rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()While looking at one unrelated syzbot bug, I found the replay logic
in __rtnl_newlink() to potentially trigger use-after-free.It is better to clear master_dev and m_ops inside the loop,
in case we have to replay it.
CVSS v3.1 score: 7.8
CVE-2026-0071 
In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v4.0 score: 10
GHSA-xqj8-j5cp-c427 
IBM API Connect 5.0.0.0 could allow a user to bypass policy restrictions and create non-compliant passwords which could be intercepted and decrypted using man in the middle techniques. IBM X-Force ID: 127160.
CVSS v3.0 score: 5.9
GHSA-hm9p-f2cp-2w64 
jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
CVSS v3.1 score: 8.8
GHSA-x2p6-jhvj-44vf 
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Oracle Forms.
GHSA-w8cq-r9p6-mc5f 
Multiple SQL injection vulnerabilities in Joomla! before 1.0.4 allow remote attackers to execute arbitrary SQL commands via the (1) Itemid variable in the Polls modules and (2) multiple unspecified methods in the mosDBTable class.
GHSA-hgxh-jg44-2849 
Improper Input validation in firmware for some Intel(R) Converged Security and Management Engine before versions 15.0.45, and 16.1.27 may allow a privileged user to potentially enable denial of service via local access.
CVSS v3.1 score: 7.2
GHSA-5m4m-582q-gp6p 
EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in installers it creates.
CVSS v3.1 score: 7.8
CVE-2016-6019 
IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 116739.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
GHSA-g95f-p29q-9xw4 Duplicate Advisory: Regular Expression Denial of Service in braces
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-cwfw-4gq5-mrqx. This link is maintained to preserve external references.Original DescriptionVersions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.RecommendationUpgrade to version 2.3.1 or higher.
CVSS v3.1 score: 3.7
CVE-2024-53334 
TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi.
CVSS v3.1 score: 8.8
RHSA-2015:1005 Red Hat Security Advisory: flash-plugin security update
flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: security bypass leading to information disclosure (APSB15-09) flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: multiple code execution issues fixed in APSB15-09 flash-plugin: information leaks leading to ASLR bypass (APSB15-09) flash-plugin: information leaks leading to ASLR bypass (APSB15-09) flash-plugin: multiple code execution issues fixed in APSB15-09
CVE-2026-74439 iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry
In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

device_pasid_table_teardown() zeroes the 128-bit scalable-mode context
entry with context_clear_entry() while the Present bit is still set. This
creates a window where the hardware can fetch a torn entry, with some
fields already zeroed while Present is still set, leading to unpredictable
behavior or spurious faults. The context-cache invalidation is issued only
after the entry has been zeroed, and intel_pasid_free_table() then frees
the PASID directory pages, so the IOMMU can keep walking a stale Present=1
entry that points at freed memory.

While x86 provides strong write ordering, the compiler may reorder the two
64-bit writes to the entry, and the hardware fetch is not guaranteed to be
atomic with respect to multiple CPU writes.

Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down
context entry") fixed this exact pattern in domain_context_clear_one() and
the copied-context path, but device_pasid_table_teardown() was not
converted.

Align it with the "Guidance to Software for Invalidations" in the VT-d
spec, Section 6.5.3.3, using the same ownership handshake as the sibling
fix: clear only the Present bit, flush it to the IOMMU, perform the
context-cache invalidation, and only then zero the rest of the entry.
CVSS v3.1 score: 9.3
GHSA-gpcw-f7pf-95mq 
Multiple cross-application scripting (XAS) vulnerabilities in Google Picasa have unspecified attack vectors and impact.  NOTE: this information is based upon a vague pre-advisory.
CVE-2026-5435 Potential buffer overflow in ns_sprintrrf TSIG handling path
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.
CVSS v3.1 score: 7.3
CVE-2024-37564 WordPress PayPlus Payment Gateway plugin <= 7.0.7 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PayPlus LTD PayPlus Payment Gateway.This issue affects PayPlus Payment Gateway: from n/a through 7.0.7.
CVSS v3.1 score: 8.5
GHSA-89p2-xv59-9v7m 
Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 7.5
CVE-2002-0855 
Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscription options in the (1) adminpw or (2) info parameters to the ml-name feature.
CVSS v2.0 score: 7.5
CVE-2025-13440 Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion
The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary wishlists.
CVSS v3.1 score: 5.3
GHSA-ff62-83w3-vf65 
Cross-site scripting (XSS) vulnerability in call_entry.php in Call Center Software 0,93 allows remote attackers to inject arbitrary web script or HTML via the problem_desc parameter, as demonstrated by the ONLOAD attribute of a BODY element.
CVE-2019-16112 
TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/ServiceManager?service=tyler.empire.settings.SettingManager URI.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
GHSA-96r9-wrq7-wv4m 
FCKeditor.Java 2.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed request parameter that contains "ctrl" characters.
CVE-2024-43521 Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
CVSS v3.1 score: 7.5
CVE-2004-0280 
Caucho Technology Resin 2.1.12 allows remote attackers to view JSP source via an HTTP request to a .jsp file that ends in a "%20" (encoded space character), e.g. index.jsp%20.
CVSS v2.0 score: 5
GHSA-g78p-m98v-8prx 
In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on.
CVSS v3.1 score: 6.8
CVE-2025-57785 Double free in XSLT in 'show_index'
A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may lead to arbitrary code execution.
CVSS v3.1 score: 6.5
CVE-2025-14655 Tenda AC20 httpd SetSysAutoRebbotCfg formSetRebootTimer stack-based overflow
A security flaw has been discovered in Tenda AC20 16.03.08.12. The impacted element is the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd. Performing a manipulation of the argument rebootTime results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
PYSEC-2026-307 
calibre-web is vulnerable to Business Logic Errors
CVSS v3.1 score: 9.8
RHSA-2026:7504 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
libtiff: Libtiff Write-What-Where libtiff: libtiff: Denial of Service via NULL pointer dereference in tif_open.c libtiff: libtiff: Denial of Service via buffer overflow libtiff: libtiff: Denial of service via double free in tiffcrop.c
CVSS v3.1 score: 5
CVE-2024-26224 Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
CVSS v3.1 score: 7.2
GHSA-rfvw-5848-gxc5 Silverstripe Flash Clipboard Reflected XSS
SilverStripe versions 3.0.0 until 4.3.5 and 4.4.4 are vulnerable to Flash Clipboard Reflected XSS. Versions 4.3.5 and 4.4.4 of `silverstripe/framework` and version 1.3.5 of `silverstripe/admin` contain a fix for this issue.
CVSS v3.1 score: 6.1
GHSA-vcfg-vcq2-8xc9 
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causing an integer overflow, possibly leading to code execution, escalation of privileges, denial of service, compromised integrity, and information disclosure. The scope of impact can extend to other components.
CVSS v3.1 score: 7.5
GHSA-h9vp-p9jj-8mmf 
Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (memory corruption and system crash) by changing a certain header, aka a "double fetch" vulnerability.
CVSS v3.0 score: 6.3
CVE-2025-38065 orangefs: Do not truncate file size
In the Linux kernel, the following vulnerability has been resolved:

orangefs: Do not truncate file size

'len' is used to store the result of i_size_read(), so making 'len'
a size_t results in truncation to 4GiB on 32-bit systems.
CVSS v3.1 score: 7.8
CVE-2020-8512 
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2026-33073 discourse-subscriptions plugin leaking stripe API key in multisite environment
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the discourse-subscriptions plugin leaks stripe API keys across sites in a multisite cluster resulting in the potential for stripe related information to be leaked across sites within the same multisite cluster. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
CVSS v4.0 score: 2
GHSA-9cv5-2h9v-98p5 
MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator privileges. Attackers can exploit the accessible device object through IOCTL handlers to manipulate kernel objects, tamper with kernel-mode callbacks, bypass Protected Process Light protections, and disable security software.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 7.8
CVE-2019-10906 
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
CVSS v3.1 score: 8.6
CVSS v2.0 score: 5
cisco-sa-intersight-forward-C45ncgqb Cisco Intersight Virtual Appliance Unauthenticated Port Forwarding Vulnerability
A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise inaccessible.

This vulnerability is due to insufficient restrictions on internally accessible http proxies. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker access to internal subnets beyond the sphere of their intended access level.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.1 score: 4.3
CVE-2025-21160 Illustrator | Integer Underflow (Wrap or Wraparound) (CWE-191)
Illustrator versions 29.1, 28.7.3 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-5m6x-qr8j-49h3 
SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands via the linkID parameter.
CVE-2022-2181 Advanced WordPress Reset < 1.6 - Reflected Cross-Site Scripting
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
CVSS v3.1 score: 6.1
GHSA-7g3h-f8vq-89vv 
A vulnerability was detected in Tenda G103 1.0.0.5. The impacted element is the function action_set_net_settings of the file gpon.lua of the component Setting Handler. Performing a manipulation of the argument authLoid/authLoidPassword/authPassword/authSerialNo/authType/oltType/usVlanId/usVlanPriority results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
CVSS v4.0 score: 2
CVSS v3.1 score: 4.7
GHSA-64pg-r7wp-qj9p 
An issue in the sch_name_to_object component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS v3.1 score: 7.5
CVE-2018-12027 
An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said socket are writable by a normal user that is not the application's user, then that non-application user can swap that directory with something else, resulting in traffic being redirected to a non-application user's process through an alternative Unix domain socket.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.5
CVE-2025-30028 
A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.
CVSS v3.1 score: 8.6
CVE-2018-4256 
In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 2.1
GHSA-q5vg-rh33-mggr 
Directory traversal vulnerability in load_language.php in CMReams CMS 1.3.1.1 Beta 2, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page_language parameter.
GHSA-mm6g-9f9f-2m6q 
Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 8.3
GHSA-cxxx-4vjm-mg8p 
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an unauthorized attacker to execute code over a network.
CVSS v3.1 score: 7.5
GHSA-pf44-w7r9-5mhh 
Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header.
CVSS v3.0 score: 7.2
GHSA-958q-f6w8-qqgc 
In the Linux kernel, the following vulnerability has been resolved:ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registeredsata_dwc_enable_interrupts() is called before platform_get_irq() and
ata_host_activate(), leaving the SATA controller's interrupt mask
enabled without a registered handler.  If a later step fails (irq
request, phy init, etc.) or if the controller asserts an interrupt
during probe, the irq line may fire with no handler, causing a
spurious interrupt storm.Move sata_dwc_enable_interrupts() after ata_host_activate() so that
interrupts are only unmasked once the handler is registered and the
core is fully initialized.
RHSA-2010:0149 Red Hat Security Advisory: kernel security and bug fix update
kernel: create_elf_tables can leave urandom in a bad state kernel: sctp remote denial of service kernel: ipv6: fix ip6_dst_lookup_tail() NULL pointer dereference
GHSA-m5f4-wpc8-674q 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.5, macOS Monterey 12.6.8, macOS Big Sur 11.7.9. Processing a file may lead to a denial-of-service or potentially disclose memory contents.
CVSS v3.1 score: 8.1
CVE-2015-8538 
dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
GHSA-h75x-vhrr-wjrq 
The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability.
CVSS v3.1 score: 7.5
GHSA-35wj-3f68-9hrj 
Cerberus Helpdesk before 4.0 (Build 600) allows remote attackers to obtain sensitive information via direct requests for "controllers ... that aren't standard helpdesk pages," possibly involving the (1) /display and (2) /kb URIs.
GHSA-235r-x7qc-64r7 
OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b.
CVSS v3.1 score: 6.5
GHSA-hj65-9wfc-jmf4 
Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be able to spoof the address bar contents. This can lead to a malicious site to appear to have the same URL as the trusted site.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 130.0.1.
CVSS v3.1 score: 6.1
CVE-2024-43447 Windows SMBv3 Server Remote Code Execution Vulnerability
Windows SMBv3 Server Remote Code Execution Vulnerability
CVSS v3.1 score: 8.1
CVE-2017-2500 
An issue was discovered in certain Apple products. Safari before 10.1.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site.
CVSS v3.0 score: 4.7
CVSS v2.0 score: 4.3
GHSA-vcv6-m499-vcw6 
Multiple unspecified vulnerabilities in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unknown impact and attack vectors related to (1) NLS Runtime and lmsgen (DB12), and (2) Oracle Text and ctxkbtc (DB14).
GHSA-2cp8-rpw3-7698 
Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the (1) subject parameter to profiles.php; (2) address1, (3) address2, (4) calendar_type, (5) city, (6) state, (7) title, (8) url, or (9) zipcode parameter to calendar/index.php; (10) title or (11) url parameter to links/index.php; or (12) PATH_INFO to admin/plugins/mediagallery/xppubwiz.php/.
CVE-2025-58857 WordPress Table of content Plugin <= 1.5.3.1 - Cross Site Request Forgery (CSRF) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Table of content content-table allows Stored XSS.This issue affects Table of content: from n/a through <= 1.5.3.1.
CVSS v3.1 score: 7.1
CVE-2023-0676 Cross-site Scripting (XSS) - Reflected in phpipam/phpipam
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
CVSS v3.0 score: 2.4
GHSA-x3qm-9gh7-w9w5 
The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
RHSA-2026:0532 Red Hat Security Advisory: kernel security update
kernel: RDMA/rxe: Fix mr->map double free kernel: nbd: fix incomplete validation of ioctl arg kernel: scsi: ses: Fix possible desc_ptr out-of-bounds accesses kernel: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL kernel: ipv6: Fix out-of-bounds access in ipv6_find_tlv() kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() kernel: smb: client: fix race with concurrent opens in rename(2) kernel: libceph: fix potential use-after-free in have_mon_and_osd_map()
CVSS v3.1 score: 7
GHSA-wg6x-8526-fqg6 
Unquoted Windows search path vulnerability in the scheduler (sched.exe) in Avira AntiVir, AntiVir Premium, Premium Security Suite, and AntiVir Professional might allow local users to gain privileges via a malicious antivir.exe file in the "C:\Program Files\avira\" directory.
RHSA-2016:2073 Red Hat Security Advisory: openssl security update
OpenSSL: Fix memory issues in BIO_*printf functions openssl: EVP_EncodeUpdate overflow openssl: EVP_EncryptUpdate overflow openssl: Padding oracle in AES-NI CBC MAC check openssl: Memory corruption in the ASN.1 encoder openssl: ASN.1 BIO handling of large amounts of data openssl: doapr_outch function does not verify that certain memory allocation succeeds
CVSS v3.0 score: 4
GHSA-rpg2-jvhp-h354 Yggdrasil Vulnerable to Local Privilege Escalation
A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages.This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data.
CVSS v3.1 score: 7.8
GHSA-6mjw-w6cc-3r69 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sk. Abul Hasan Animated Number Counters allows PHP Local File Inclusion.This issue affects Animated Number Counters: from n/a through 1.9.
CVSS v3.1 score: 6.5
CVE-2018-6536 
An issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for icinga2.pid modification before a root script executes a "kill `cat /pathname/icinga2.pid`" command, as demonstrated by icinga2.init.d.cmake.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.9
CVE-2017-1001000 
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-wv6m-q5g2-j9v4 
Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the set[template][value] parameter.
GHSA-gh77-92x7-j48m 
A vulnerability has been found in Auto Upload Images 3.3.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.3.2 is able to address this issue. The name of the patch is 895770ee93887ec78429c78ffdfb865bee6f9436. It is recommended to upgrade the affected component. The identifier VDB-216481 was assigned to this vulnerability.
CVSS v3.1 score: 6.1
CVE-2006-1861 
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c.  NOTE: item 4 was originally identified by CVE-2006-2493.
CVSS v2.0 score: 7.5
GHSA-px3f-ghhp-7f3w 
In the Linux kernel, the following vulnerability has been resolved:rxrpc: Fix ACKALL packet handlingrxrpc_input_ackall() accepts ACKALL packets without checking whether the
call is in a state that can legitimately have outstanding transmit buffers.
A forged ACKALL can therefore reach a new service call in
RXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued.In that state call->tx_top is zero and call->tx_queue is NULL, so
rxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a
null-pointer dereference.Fix the handling of ACKALL packets by the following means:(1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates
     that the client call is connected, but nothing has been transmitted as
     yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything
     has been transmitted at least once, but we're now waiting for the
     stuff remaining in the Tx buffer to be ACK'd (retransmissions may
     still happen).(2) As per Wyatt Feng's original patch[1], the ACKALL handler then checks
     that the call state is one in which there might be stuff in the Tx
     buffer to ACK, but now this includes AWAIT_ACK rather than
     AWAIT_REPLY.  ACKALL packets are ignored if received in the wrong
     state.(3) Make the ACKALL handler use call->tx_transmitted rather than
     call->tx_top as the former is explicitly the highest packet seq number
     transmitted, whereas the latter has a looser definition.Thanks to Jeffrey Altman for a description of the history of the ACKALL
packet[1].
CVSS v3.1 score: 7.5
CVE-2005-3991 
Multiple cross-site scripting (XSS) vulnerabilities in phpMyChat 0.14.6 allow remote attackers to inject arbitrary web script or HTML via the medium parameter to (1) start_page.css.php and (2) style.css.php; or the From parameter to users_popupL.php.
CVSS v2.0 score: 4.3
GHSA-99w7-h4pv-6cx2 
Unrestricted file upload vulnerability in saa.php in Andy's PHP Knowledgebase (aphpkb) 0.92.9 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a link that is listed by authors.php.
GHSA-c8p6-443q-9mqj 
An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application, grant device admin permission and then delete several installed application.
CVSS v3.1 score: 8.8
GHSA-78mp-rgcx-c47v 
The Protected Node module 6.x-1.x before 6.x-1.6 for Drupal does not properly "protect node access when nodes are accessed outside of the standard node view," which allows remote attackers to bypass intended access restrictions.
CVE-2026-32719 AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The ImportedPlugin.importCommunityItemFromUrl() function in server/utils/agents/imported.js downloads a ZIP file from a community hub URL and extracts it using AdmZip.extractAllTo() without validating file paths within the archive. This enables a Zip Slip path traversal attack that can lead to arbitrary code execution.
CVSS v3.1 score: 4.2
GHSA-fxrw-q665-w573 
Cross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified actions as unspecified other authenticated users via the Shutdown message.
GHSA-gp5f-6cr8-73qf 
A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /expadd.php. The manipulation of the argument expcat leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVE-2021-26857 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS v3.1 score: 7.8
GHSA-c9vj-5wx9-69pj 
A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /filemanager.php of the component POST Parameter Handler. The manipulation of the argument file[] results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 5.4