CIRCL/vulnerability-scores huggingface dataset:
CVE-2006-0156 
Cross-site scripting (XSS) vulnerability in Foxrum 4.0.4f allows remote attackers to inject arbitrary Javascript via the javascript URI in bbcode url tags in (1) addpost1.php and (2) addtopic1.php.
CVSS v2.0 score: 4.3
CVE-2017-18590 
The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-g63g-wvh8-wwm8 
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB MART 1.7 and earlier might allow remote attackers to inject arbitrary web script or HTML via a crafted cookie.
GHSA-m4x5-5vgj-cxfj 
cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).
CVSS v3.0 score: 7.8
GHSA-m68p-4w8c-8x3r 
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15332.
CVSS v3.1 score: 9.8
GHSA-4v78-j8g9-rpv2 
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks.
CVSS v3.1 score: 5.4
GHSA-7vx3-5mq4-mccg 
Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults to bypass RMP checks in SEV-SNP, potentially leading to a loss of guest memory integrity.
CVSS v3.1 score: 5.3
GHSA-xp3x-85w4-72px 
Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.
GHSA-3v8f-7593-ph9g 
An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.
CVSS v4.0 score: 8.2
GHSA-ph7q-mhxg-qmwr 
A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. The impacted element is an unknown function of the file /admin/inv-print.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
CVE-2020-15496 
Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 4.6
CVE-2023-35915 WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.
CVSS v3.1 score: 7.6
GHSA-3gpm-78pq-33vj 
MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.TAB with overly permissive filesystem access. A local authenticated user with read access to this file can recover all user passwords and super-admin credentials, then use them to authenticate to MailEnable services such as POP3, SMTP, or the webmail interface, enabling unauthorized mailbox access and administrative control.
CVSS v4.0 score: 6.8
CVSS v3.1 score: 7.8
CVE-2026-22922 Apache Airflow: Airflow externalLogUrl Permission Bypass
Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. 

Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.
CVSS v3.1 score: 6.5
CVE-2022-3351 
An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A user's primary email may be disclosed to an attacker through group member events webhooks.
CVSS v3.1 score: 4.3
CVE-2024-7607 Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection
The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1 score: 8.8
RHSA-2021:3076 Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header golang: archive/zip: malformed archive may cause panic or memory exhaustion golang: crypto/tls: certificate of wrong type is causing TLS client to panic
CVSS v3.1 score: 6.5
GHSA-7g3p-h5cq-7xhf 
A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decode_vol_header of the file libavcodec/mpeg4videodec.c. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS v3.1 score: 5.5
CVE-2009-4733 
SQL injection vulnerability in checkuser.php in SimpleLoginSys 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 score: 6.8
CVE-2009-1034 
SQL injection vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via values in the URI.
CVSS v2.0 score: 10
CVE-2026-5318 LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write
A weakness has been identified in LibRaw up to 0.22.0. This impacts the function HuffTable::initval of the file src/decompressors/losslessjpeg.cpp of the component JPEG DHT Parser. This manipulation of the argument bits[] causes out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.22.1 will fix this issue. Patch name: a6734e867b19d75367c05f872ac26322464e3995. It is advisable to upgrade the affected component.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 5
CVE-2021-24937 Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting
The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
RHSA-2018:0016 Red Hat Security Advisory: kernel-rt security update
hw: cpu: speculative execution branch target injection hw: cpu: speculative execution bounds-check bypass hw: cpu: speculative execution permission faults handling
CVSS v3.0 score: 5.5
GHSA-m6w4-2fwf-p3mx 
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.
CVSS v3.0 score: 8.8
GHSA-6wm7-ww95-2pjw 
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_files' function in all versions up to, and including, 0.9.112. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
CVSS v3.1 score: 7.2
CVE-2019-15273 Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities
Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwrite arbitrary files. The vulnerabilities are due to insufficient permission enforcement. An attacker could exploit these vulnerabilities by authenticating as the remote support user and submitting malicious input to specific commands. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying filesystem. The attacker has no control over the contents of the data written to the file. Overwriting a critical file could cause the device to crash, resulting in a denial of service condition (DoS).
CVSS v3.0 score: 6
CVE-2026-24734 Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


The following versions were EOL at the time the CVE was created but are 
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
CVSS v3.1 score: 7.4
CVE-2020-12281 
iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
CVE-2003-1498 
Cross-site scripting (XSS) vulnerability in search.php for WRENSOFT Zoom Search Engine 2.0 Build 1018 and earlier allows remote attackers to inject arbitrary web script or HTML via the zoom_query parameter.
CVSS v2.0 score: 4.3
GHSA-rm99-52xq-2r9w 
A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.
CVSS v3.1 score: 6.5
RHSA-2026:9205 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
dotnet: .NET and Visual Studio Spoofing Vulnerability dotnet: .NET Denial of Service Vulnerability dotnet: .NET Information Disclosure Vulnerability dotnet: .NET Security Feature Bypass Vulnerability dotnet: .NET: Security Bypass and Denial of Service Vulnerability dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw dotnet: .NET: Denial of Service via stack overflow dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform
CVSS v3.1 score: 7.5
GHSA-jjm9-3gv3-8hp8 
There is an an information disclosure vulnerability in ZTE T5400. Due to improper configuration of the access control mechanism, attackers can obtain information through interfaces without authorization, causing the risk of information disclosure.
CVSS v3.1 score: 3.5
GHSA-6whc-m4v6-hr38 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2440.
CVE-2023-37469 CasaOS Command Injection vulnerability
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.
CVSS v3.1 score: 8.8
CVE-2022-28759 Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.
CVSS v3.1 score: 8.2
GHSA-66v8-c34p-jmrm 
A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest.Obtain any valid token with only read scope.Connect to the normal production gRPC API (kuksa.val.v2).Open OpenProviderStream.Send ProvideSignalRequest for a target signal ID.Wait for the broker to forward GetProviderValueRequest.Reply with attacker-controlled GetProviderValueResponse.Other clients performing GetValue / GetValues for that signal receive forged data.
CVSS v4.0 score: 8.5
GHSA-9fpw-c9x7-cv3j Mattermost allows remote actor to set arbitrary RemoteId values for synced users
Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 2.7
CVE-2023-43847 
Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to control all the outlets as if they were the administrator via HTTP POST requests.
CVSS v3.1 score: 5.3
CVE-2026-40384 Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.
CVSS v4.0 score: 5.9
CVE-2024-1174 
Previous versions of HP ThinPro (prior to HP ThinPro 8.0 SP 8) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.0 SP 8, which includes updates to mitigate potential vulnerabilities.
CVSS v3.1 score: 8.2
CVE-2026-64529 crypto: qat - remove unused character device and IOCTLs
In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - remove unused character device and IOCTLs

The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs
for device configuration, start, stop, status query and enumeration.
These IOCTLs are not part of any public uAPI header and have no known
in-tree or out-of-tree users. Device lifecycle is already managed via
sysfs.

The ioctl interface also increases the attack surface and is the
subject of a number of bug reports.

Remove the character device, the IOCTL definitions, and the related
data structures (adf_dev_status_info, adf_user_cfg_key_val,
adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused
adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal
module_init/module_exit hooks for workqueue, AER, and crypto/compression
algorithm registration.

Clean up leftover dead code that was only reachable from the removed
IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),
adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),
adf_get_vf_real_id() and the unused ADF_CFG macros.

Additionally, drop the entry associated to QAT IOCTLs in
ioctl-number.rst.
CVSS v3.1 score: 7.8
GHSA-3xv6-f2f8-6gf4 
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Web Services). The supported version that is affected is 10.3.6.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.1 score: 7.5
CVE-2024-20424 
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system as root.
 This vulnerability is due to insufficient input validation of certain HTTP requests. An attacker could exploit this vulnerability by authenticating to the web-based management interface of an affected device and then sending a crafted HTTP request to the device. A successful exploit could allow the attacker to execute arbitrary commands with root permissions on the underlying operating system of the Cisco FMC device or to execute commands on managed Cisco Firepower Threat Defense (FTD) devices. To exploit this vulnerability, the attacker would need valid credentials for a user account with at least the role of Security Analyst (Read Only).
CVSS v3.1 score: 9.9
CVE-2022-29104 Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.8
GHSA-2mqx-pp9v-pgr6 
Use-after-free vulnerability in the GPU process in Google Chrome before 10.0.648.205 allows remote attackers to execute arbitrary code via unknown vectors.
GHSA-gpj5-9ww2-3h4p 
libs/binder/IPCThreadState.cpp in Binder in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 mishandles object references, which allows attackers to gain privileges via a crafted application, aka internal bug 27252896.
CVSS v3.0 score: 7.8
CVE-2025-5869 RT-Thread lwp_syscall.c sys_recvfrom memory corruption
A vulnerability, which was classified as critical, was found in RT-Thread 5.1.0. Affected is the function sys_recvfrom of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument from leads to memory corruption.
CVSS v4.0 score: 8.6
CVSS v3.1 score: 8
CVSS v3.0 score: 8
CVSS v2.0 score: 7.7
GHSA-gg5w-cwgx-vm84 
Adobe Dimension versions 3.4.9 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
CVE-2023-36250 
CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.
CVSS v3.1 score: 7.8
GHSA-j4w2-w4h6-3353 
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the mode parameter to /cgi-bin/cstecgi.cgi.
CVSS v3.1 score: 6.5
CVE-2018-11489 
The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain CrntCode array index is not checked. This will lead to a denial of service or possibly unspecified other impact.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
GHSA-xxpp-89v4-96px 
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove.
CVSS v3.0 score: 7.3
CVE-2024-7154 TOTOLINK A3700R Password Reset wizard.html access control
A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.html of the component Password Reset Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272568. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
CVE-2010-1267 
Multiple directory traversal vulnerabilities in WebMaid CMS 0.2-6 Beta and earlier allow remote attackers to read arbitrary files via directory traversal sequences in the com parameter to (1) cContactus.php, (2) cGuestbook.php, and (3) cArticle.php.
CVSS v2.0 score: 5
CVE-2021-1452 Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability
A vulnerability in the ROM Monitor (ROMMON) of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE3400 Heavy Duty Series Switches, and Cisco Embedded Services 3300 Series Switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. This vulnerability is due to incorrect validations of specific function arguments passed to a boot script when specific ROMMON variables are set. An attacker could exploit this vulnerability by setting malicious values for a specific ROMMON variable. A successful exploit could allow the attacker to execute unsigned code and bypass the image verification check during the secure boot process of an affected device. To exploit this vulnerability, the attacker would need to have unauthenticated, physical access to the device or obtain privileged access to the root shell on the device.
CVSS v3.1 score: 6.8
GHSA-qq9g-96v4-m3cj Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas
SummaryThe Select schema plugin in `@pdfme/schemas` constructs HTML from template-defined option values using unsanitized string interpolation and sets it via `innerHTML`, enabling arbitrary JavaScript execution.DetailsIn `packages/schemas/src/select/index.ts`, lines 159-164, the Select schema's `ui` renderer builds `<option>` elements by directly interpolating option values from the template into an HTML string:The `option` values come from `schema.options`, which is an array of strings defined in the template JSON. These values are interpolated directly into the HTML string without any escaping of `<`, `>`, `"`, `&`, or other HTML-special characters. An option value containing `">` breaks out of the `value` attribute and allows injection of arbitrary HTML elements and event handlers.Proof of ConceptLoading the following template into a pdfme Form or Designer component triggers JavaScript execution:The injected `<img onerror>` element executes JavaScript because it is parsed as HTML when assigned to `selectElement.innerHTML`.Attack VectorsThe `options` array is defined in the template (not by form-filling end users). The attack requires a malicious template to be loaded, which can happen via:File upload (e.g., "Load Template" functionality in applications)Shared/imported templates in multi-tenant applicationsTemplates stored in databases without content sanitizationThe `updateTemplate()` API being called with untrusted dataThis vulnerability is triggered in Form mode (for non-readOnly select fields) and Designer mode when the select element is rendered.ImpactAn attacker who can supply a malicious template can execute arbitrary JavaScript in the browser of any user who views or interacts with the template. This enables:Session hijacking via cookie/token theftKeylogging of form input dataPhishing and page modificationData exfiltrationSuggested FixUse DOM APIs to create option elements safely instead of string interpolation:Alternatively, HTML-encode option values before interpolation:
CVSS v3.1 score: 6.1
GHSA-54w6-f3f8-54q2 
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to break out of its sandbox.
CVSS v3.1 score: 8.8
CVE-2011-2136 
Integer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-2138 and CVE-2011-2416.
CVSS v2.0 score: 10
CVE-2024-56647 net: Fix icmp host relookup triggering ip_rt_bug
In the Linux kernel, the following vulnerability has been resolved:

net: Fix icmp host relookup triggering ip_rt_bug

arp link failure may trigger ip_rt_bug while xfrm enabled, call trace is:

WARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20
Modules linked in:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:ip_rt_bug+0x14/0x20
Call Trace:
 <IRQ>
 ip_send_skb+0x14/0x40
 __icmp_send+0x42d/0x6a0
 ipv4_link_failure+0xe2/0x1d0
 arp_error_report+0x3c/0x50
 neigh_invalidate+0x8d/0x100
 neigh_timer_handler+0x2e1/0x330
 call_timer_fn+0x21/0x120
 __run_timer_base.part.0+0x1c9/0x270
 run_timer_softirq+0x4c/0x80
 handle_softirqs+0xac/0x280
 irq_exit_rcu+0x62/0x80
 sysvec_apic_timer_interrupt+0x77/0x90

The script below reproduces this scenario:
ip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \
	dir out priority 0 ptype main flag localok icmp
ip l a veth1 type veth
ip a a 192.168.141.111/24 dev veth0
ip l s veth0 up
ping 192.168.141.155 -c 1

icmp_route_lookup() create input routes for locally generated packets
while xfrm relookup ICMP traffic.Then it will set input route
(dst->out = ip_rt_bug) to skb for DESTUNREACH.

For ICMP err triggered by locally generated packets, dst->dev of output
route is loopback. Generally, xfrm relookup verification is not required
on loopback interfaces (net.ipv4.conf.lo.disable_xfrm = 1).

Skip icmp relookup for locally generated packets to fix it.
CVSS v3.1 score: 5.5
GHSA-pqw9-5fgf-mj94 
Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident module editing function at /bmis/pages/resident/resident.php.
CVSS v3.1 score: 7.2
GHSA-57j4-jv54-9h84 
A vulnerability in the fragmentation handling code of tunnel protocol packets in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected system to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the improper handling of large fragmented tunnel protocol packets. One example of a tunnel protocol is Generic Routing Encapsulation (GRE). An attacker could exploit this vulnerability by sending crafted fragmented packets to an affected system. A successful exploit could allow the attacker to cause the affected system to reload, resulting in a DoS condition. Note: Only traffic directed to the affected system can be used to exploit this vulnerability.
CVSS v3.1 score: 8.6
GHSA-mv7p-34fv-4874 Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
ImpactCVE-2025-13877 is an **authentication bypass vulnerability caused by insecure default JWT key usage** in NocoBase Docker deployments.Because the official one-click Docker deployment configuration historically provided a **public default JWT key**, attackers can **forge valid JWT tokens without possessing any legitimate credentials**. By constructing a token with a known `userId` (commonly the administrator account), an attacker can directly bypass authentication and authorization checks.Successful exploitation allows an attacker to:Bypass authentication entirelyImpersonate arbitrary usersGain full administrator privilegesAccess sensitive business dataCreate, modify, or delete usersAccess cloud storage credentials and other protected secretsThe vulnerability is **remotely exploitable**, requires **no authentication**, and **public proof-of-concept exploits are available**.  
This issue is functionally equivalent in impact to other JWT secret exposure vulnerabilities such as **CVE-2024-43441** and **CVE-2025-30206**.Deployments that used the default Docker configuration without explicitly overriding the JWT secret are affected.Patches✅ The vulnerability has been **fully patched** through a secure JWT key management redesign.The remediation enforces the following security guarantees:JWT secrets are no longer allowed to fall back to public default values.Secrets must either:Be explicitly provided by the user, orBe securely generated using cryptographically strong randomness at first startup.Generated secrets are persisted securely with restricted filesystem permissions.Invalid or weak secret values immediately trigger a startup failure.✅ Fixed Versions:**NocoBase ≥ 1.9.23****NocoBase ≥ 1.9.0-beta.18****NocoBase ≥ 2.0.0-alpha.52**WorkaroundsIf upgrading is not immediately possible, the following temporary mitigations **must** be performed to reduce risk:Explicitly set a **strong, randomly generated JWT secret** via environment variables `APP_KEY`.**Restart all running NocoBase instances** so the new secret takes effect.**Invalidate all existing JWT sessions**, forcing complete user re-authentication.Verify that **no default secret values** are present in:`docker-compose.yml``.env` filesKubernetes SecretsReferences**CVE Record:** CVE-2025-13877**VulDB Entry:** https://vuldb.com/?id.334033**Public Exploit Proof:**  
https://gist.github.com/H2u8s/f3ede60d7ecfe598ae452aa5a8fbb90d**Affected Default Docker Configurations:**https://github.com/nocobase/nocobase/blob/main/docker/app-mysql/docker-compose.yml#L13https://github.com/nocobase/nocobase/blob/main/docker/app-mariadb/docker-compose.yml#L13https://github.com/nocobase/nocobase/blob/main/docker/app-postgres/docker-compose.yml#L11https://github.com/nocobase/nocobase/blob/main/docker/app-sqlite/docker-compose.yml#L11**Official Deployment Documentation:**https://docs.nocobase.com/welcome/getting-started/installation/docker-composehttps://v2.docs.nocobase.com/get-started/installation/docker
CVSS v4.0 score: 6.3
GHSA-3566-jfm7-38ph 
PHP remote file inclusion vulnerability in save.php in phpSANE 0.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the file_save parameter.
CVE-2025-46987 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
CVE-2016-7388 
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
CVE-2024-29752 
In tmu_set_tr_num_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 7.8
GHSA-rxjj-p248-4ffv 
Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php.
CVSS v3.1 score: 9.8
GHSA-w9qw-39gf-jp7r 
A heap buffer overflow vulnerability has been identified in the lcms2-2.16. The vulnerability exists in the UnrollChunkyBytes function in cmspack.c, which is responsible for handling color space transformations.
CVSS v3.1 score: 7.3
CVE-2010-0674 
StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for path/stats.mdb.
CVSS v2.0 score: 5
CVE-2025-61871 
NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
CVSS v4.0 score: 8.4
CVSS v3.0 score: 6.7
CVE-2005-1189 
Cross-site scripting (XSS) vulnerability in WebcamXP PRO v2.16.468 and earlier allows remote attackers to inject arbitrary web script or HTML via the chat name, as demonstrated by using an IFRAME to redirect users to other sites.
CVSS v2.0 score: 4.3
GHSA-j28f-v5r4-q9fp 
An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack affecting idm, nbars, and SLP manager code.
CVSS v3.1 score: 9.8
CVE-2019-15494 
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-gwh7-h623-wx42 
Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.
CVSS v3.1 score: 5.4
GHSA-5cp5-8443-8v7r 
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install).  Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 7.8
CVE-2016-3306 
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 mishandles session objects, which allows local users to hijack sessions, and consequently gain privileges, via a crafted application, aka "Windows Session Object Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3305.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 4.6
GHSA-7c93-fq84-vgf7 
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to Java APIs.
RHSA-2016:1475 Red Hat Security Advisory: java-1.8.0-oracle security update
OpenJDK: insufficient restrictions on the use of custom ValueHandler (CORBA, 8079718) JDK: unspecified vulnerability fixed in 7u111 and 8u101 (JavaFX) OpenJDK: maximum XML name limit not applied to namespace URIs (JAXP, 8148872) JDK: unspecified vulnerability fixed in 6u121, 7u111, and 8u101 (Install) OpenJDK: missing entity replacement limits (JAXP, 8149962) JDK: unspecified vulnerability fixed in 7u111 and 8u101 (Deployment) OpenJDK: integer overflows in bytecode streams (Hotspot, 8152479) JDK: unspecified vulnerability fixed in 8u101 (Install) OpenJDK: insufficient protection of MethodHandle.invokeBasic() (Hotspot, 8154475) OpenJDK: incorrect handling of MethodHandles.dropArguments() argument (Libraries, 8155985) OpenJDK: insufficient bytecode verification (Hotspot, 8155981) OpenJDK: insufficient value count check in MethodHandles.filterReturnValue() (Libraries, 8158571)
CVSS v3.0 score: 8.8
CVE-2026-40841 Authenticated SQLi in getProjectTags function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
GHSA-hwxq-q96q-4j44 
A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS v3.1 score: 5.4
CVE-2021-3321 Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal
Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions >= >=2.4.0 contain Integer Overflow to Buffer Overflow (CWE-680). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99
CVSS v3.1 score: 7.5
GHSA-rgq3-q5rc-mjc3 
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.0 via the `wpo_ips_edi_save_order_customer_peppol_identifiers` AJAX action due to missing capability checks and order ownership validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify Peppol/EDI endpoint identifiers (`peppol_endpoint_id`, `peppol_endpoint_eas`) for any customer by specifying an arbitrary `order_id` parameter on systems using Peppol invoicing. This can affect order routing on the Peppol network and may result in payment disruptions and data leakage.
CVSS v3.1 score: 4.3
CVE-2026-73574 
In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.
CVSS v3.1 score: 3.1
GHSA-cg6h-7cf6-v3hp 
This issue was addressed with a new entitlement. This issue is fixed in iOS 12.1. A local user may be able to read a persistent device identifier.
CVE-2024-33003 Information Disclosure Vulnerability in SAP Commerce Cloud
Some OCC API endpoints in SAP Commerce Cloud
allows Personally Identifiable Information (PII) data, such as passwords, email
addresses, mobile numbers, coupon codes, and voucher codes, to be included in
the request URL as query or path parameters. On successful exploitation, this
could lead to a High impact on confidentiality and integrity of the
application.
CVSS v3.1 score: 7.4
CVE-2013-1758 
Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pfad parameter to wp-admin/options-general.php.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 score: 4.3
CVE-2025-30966 WordPress WPJobBoard plugin < 5.11.1 - Path Traversal vulnerability
Path Traversal vulnerability in NotFound WPJobBoard allows Path Traversal. This issue affects WPJobBoard: from n/a through n/a.
CVSS v3.1 score: 5.4
GHSA-4v24-3w3q-g36w 
Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information.
CVSS v3.1 score: 4.7
CVE-2024-36971 net: fix __dst_negative_advice() race
In the Linux kernel, the following vulnerability has been resolved:

net: fix __dst_negative_advice() race

__dst_negative_advice() does not enforce proper RCU rules when
sk->dst_cache must be cleared, leading to possible UAF.

RCU rules are that we must first clear sk->sk_dst_cache,
then call dst_release(old_dst).

Note that sk_dst_reset(sk) is implementing this protocol correctly,
while __dst_negative_advice() uses the wrong order.

Given that ip6_negative_advice() has special logic
against RTF_CACHE, this means each of the three ->negative_advice()
existing methods must perform the sk_dst_reset() themselves.

Note the check against NULL dst is centralized in
__dst_negative_advice(), there is no need to duplicate
it in various callbacks.

Many thanks to Clement Lecigne for tracking this issue.

This old bug became visible after the blamed commit, using UDP sockets.
CVSS v3.1 score: 7.8
CVE-2026-25746 OpenEMR has SQL Injection Vulnerability
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulnerability in prescription that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the prescription listing functionality. Version 8.0.0 fixes the vulnerability.
CVSS v3.1 score: 8.8
CVE-2026-14237 Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation
The vitepos WordPress plugin before 3.6.0, Vitepos  WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
CVSS v3.1 score: 7.2
GHSA-84mj-jmvq-2m8m 
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
GHSA-fvmx-w547-hmqf 
Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to "upload file functionality."
CVSS v3.0 score: 9.8
CVE-2023-5844 Unverified Password Change in pimcore/admin-ui-classic-bundle
Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.
CVSS v3.0 score: 4.3
CVE-2013-4184 
Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks
CVSS v3.1 score: 5.5
CVSS v2.0 score: 3.6
CVE-2025-22486 File Station 5
An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system.

We have already fixed the vulnerability in the following versions:
File Station 5 5.5.6.4791 and later
  and later
CVSS v4.0 score: 7.1
CVE-2022-30356 
OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege.
CVSS v3.1 score: 8.8
CVE-2026-63409 Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vector during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain and crash the connected client. This issue is fixed in continuous build 1.26.0.296.
CVSS v3.1 score: 8.2
CVE-2025-49284 WordPress WP Maintenance Mode & Site Under Construction plugin <= 4.3 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through <= 4.3.
CVSS v3.1 score: 4.3
GHSA-5pvj-v3p5-pc28 
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to Activity Guide.
CVSS v3.0 score: 7.4
CVE-2021-41738 
ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
GHSA-2w2x-7266-2c97 
A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the user connects to an SSL VPN Gateway.
GHSA-786g-xv8v-9h93 Moodle Cross-site Scripting vulnerability
In Moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.
CVSS v3.1 score: 5.4
CVE-2021-38351 OSD Subscribe <= 1.2.3 Reflected Cross-Site Scripting
The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/options/osd_subscribe_options_subscribers.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.3.
CVSS v3.1 score: 6.1
CVE-2017-5217 
Installing a zero-permission Android application on certain Samsung Android devices with KK(4.4), L(5.0/5.1), and M(6.0) software can continually crash the system_server process in the Android OS. The zero-permission app will create an active install session for a separate app that it has embedded within it. The active install session of the embedded app is performed using the android.content.pm.PackageInstaller class and its nested classes in the Android API. The active install session will write the embedded APK file to the /data/app directory, but the app will not be installed since third-party applications cannot programmatically install apps. Samsung has modified AOSP in order to accelerate the parsing of APKs by introducing the com.android.server.pm.PackagePrefetcher class and its nested classes. These classes will parse the APKs present in the /data/app directory and other directories, even if the app is not actually installed. The embedded APK that was written to the /data/app directory via the active install session has a very large but valid AndroidManifest.xml file. Specifically, the AndroidManifest.xml file contains a very large string value for the name of a permission-tree that it declares. When system_server tries to parse the APK file of the embedded app from the active install session, it will crash due to an uncaught error (i.e., java.lang.OutOfMemoryError) or an uncaught exception (i.e., std::bad_alloc) because of memory constraints. The Samsung Android device will encounter a soft reboot due to a system_server crash, and this action will keep repeating since parsing the APKs in the /data/app directory as performed by the system_server process is part of the normal boot process. The Samsung ID is SVE-2016-6917.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 7.1
GHSA-9qfw-82fr-g926 
common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions.
CVE-2023-33162 Microsoft Excel Information Disclosure Vulnerability
Microsoft Excel Information Disclosure Vulnerability
CVSS v3.1 score: 5.5
CVE-2026-11426 UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter
The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin accepting arbitrary local file paths in the template_thumbnail parameter and copying their contents into a publicly accessible uploads file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary files on the server, which can contain sensitive information.
CVSS v3.1 score: 6.5
CVE-2023-25032 WordPress Print, PDF, Email by PrintFriendly Plugin <= 5.5.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Print, PDF, Email by PrintFriendly plugin <= 5.5.1 versions.
CVSS v3.1 score: 5.9