CIRCL/vulnerability-scores huggingface dataset:
CVE-2026-55666 Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAuth flow. The try block checks for an email parameter. If the JWT does not contain an email address, the application falls back to accepting an arbitrary email value supplied directly in the request. Attackers are able to forge Apple JWTs that do not contain an email address and leverage this vulnerability to carry out account takeover attacks. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.
CVSS v4.0 score: 9.3
CVE-2018-13567 
The mintToken function of a smart contract implementation for SDR, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-5h29-fw25-j6vg 
Multiple cross-site scripting (XSS) vulnerabilities in Bugzero 4.3.1 and other versions allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in query.jsp and (2) entryId parameter in edit.jsp.
GHSA-qj62-79j9-vf3g 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography: from n/a through < 7.7.5.
CVSS v3.1 score: 8.1
CVE-2022-24496 Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.8
CVE-2024-28042 SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy Component
SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center.
CVSS v4.0 score: 8.6
CVSS v3.1 score: 8.4
CVE-2008-2391 
SubSonic allows remote attackers to bypass pagesize limits and cause a denial of service (CPU consumption) via a pageindex (aka data page number) of -1.
CVSS v2.0 score: 7.8
GHSA-4r9p-cvjh-239m 
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
CVSS v3.0 score: 6.1
GHSA-w4qh-6p6w-4424 
Cross-site scripting (XSS) vulnerability in usercp.php in MyBB (aka MyBulletinBoard) 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter.
RHSA-2017:2675 Red Hat Security Advisory: Red Hat Mobile Application Platform security update
RHMAP Millicore IDE allows RCE on SCM RHMAP: SSRF via external_request feature of App Studio RHMAP: Stored XSS in App Store git: Command injection via malicious ssh URLs
CVSS v3.0 score: 6.3
CVE-2004-1850 
The Rage 1.01 and earlier allows remote attackers to cause a denial of service (infinite loop) via a TCP packet with the port and IP address set to zero.
CVSS v2.0 score: 5
CVE-2022-22967 
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
CVE-2012-3471 
Multiple SQL injection vulnerabilities in the edit functions in (1) application/controllers/admin/reports.php and (2) application/controllers/members/reports.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via an incident id.
CVSS v2.0 score: 7.5
CVE-2026-6977 vanna-ai vanna Legacy Flask API improper authorization
A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
RHSA-2012:1594 Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update
httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled httpd: insecure handling of LD_LIBRARY_PATH in envvars apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token Mojarra: deployed web applications can read FacesContext from other applications under certain conditions httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains apache-cxf: SOAPAction spoofing on document literal web services JBoss Enterprise Application Platform: org.jboss.as.ejb3: JBoss Enterprise Application Platform: Access restriction bypass via improper EJB method authorization JBoss Enterprise Application Platform: JBoss EAP: JBEAP: JBoss Enterprise Application Platform: Unauthorized EJB access via authorization module bypass
CVSS v3.1 score: 5.3
CVE-2020-1667 Junos OS: MX Series: Services card might restart due to a race condition when DNS filtering is enabled.
When DNS filtering is enabled on Juniper Networks Junos MX Series with one of the following cards MS-PIC, MS-MIC or MS-MPC, an incoming stream of packets processed by the Multiservices PIC Management Daemon (mspmand) process might be bypassed due to a race condition. Due to this vulnerability, mspmand process, responsible for managing "URL Filtering service", can crash, causing the Services PIC to restart. While the Services PIC is restarting, all PIC services including DNS filtering service (DNS sink holing) will be bypassed until the Services PIC completes its boot process. This issue affects Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S8; 18.3 versions prior to 18.3R3-S1; 18.4 versions prior to 18.4R3; 19.1 versions prior to 19.1R3; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R3. This issue does not affect Juniper Networks Junos OS 17.4, 18.1, and 18.2.
CVSS v3.1 score: 8.3
GHSA-3f62-5j79-h47w 
Cross-Site Request Forgery (CSRF) vulnerability in Anshul Labs Mobile Address Bar Changer plugin <= 3.0 versions.
CVSS v3.1 score: 4.3
CVE-2025-51005 
A heap-buffer-overflow vulnerability exists in the tcpliveplay utility of the tcpreplay-4.5.1. When a crafted pcap file is processed, the program incorrectly handles memory in the checksum calculation logic at do_checksum_math_liveplay in tcpliveplay.c, leading to a possible denial of service.
CVSS v3.1 score: 7.5
GHSA-3794-c67g-vh97 
In postInstantAppNotif of InstantAppNotifier.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.0 Android-8.1 Android-9Android ID: A-154719656
GHSA-h9xw-f6mh-953j 
Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitization (agent/src/live/mandate/commit.py). A proposal identifier containing path traversal sequences causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate. Combined with the file upload endpoint, an admitted caller can write a JSON file to a known location and traverse to it, and because the ceilings validation is skipped when ceilings are absent, the attacker fully controls the committed mandate.
CVSS v4.0 score: 7.2
CVSS v3.1 score: 8.3
GHSA-7x76-cmrq-q6j7 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter.
CVSS v3.1 score: 7.5
CVE-2024-48907 
Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API.
CVSS v3.1 score: 7.5
GHSA-p5hf-25jf-vgj9 
In BIG-IP ASM versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed server cookie scenario may cause BD to restart under some circumstances.
CVE-2026-5683 Tenda CX12L P2pListFilter fromP2pListFilter stack-based overflow
A vulnerability was found in Tenda CX12L 16.03.53.12. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack must originate from the local network. The exploit has been made public and could be used.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 5.5
CVSS v3.0 score: 5.5
CVSS v2.0 score: 5.2
GHSA-h35x-c82g-hxx8 
A vulnerability was found in OpenSight Software FlashFXP 5.4.0.3970. It has been classified as critical. Affected is an unknown function in the library libcrypto-1_1.dll of the file FlashFXP.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 7.8
CVE-2022-32771 
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "success" parameter which is inserted into the document with insufficient sanitization.
CVSS v3.0 score: 9.6
CVE-2024-13951 One way hash with predictable salt
One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
CVSS v4.0 score: 6.1
CVSS v3.1 score: 7.6
CVE-2026-72692 OpenSignLabs opensignserver - Missing Authorization
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.
CVSS v3.1 score: 7.5
GHSA-ggc6-8q3j-pc53 
In TBD of TBD, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239847859References: N/A
CVSS v3.1 score: 7.8
GHSA-9mvx-mp3h-cm56 
Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, and RH2288H V3 servers with software before V100R003C00SPC515 allow remote attackers to obtain passwords via a brute-force attack, related to "lack of authentication protection mechanisms."
CVSS v3.0 score: 9.8
GHSA-rg26-vvq3-pr34 
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
CVSS v3.1 score: 7.2
GHSA-cg72-7hgw-x23f 
Missing Authorization vulnerability in WP Delicious Delisho allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Delisho: from n/a through 1.1.3.
CVSS v3.1 score: 4.3
GHSA-5c28-8ww8-7qf3 
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that
could cause unauthorized read access to the file system when a malicious configuration file is
loaded on to the software by a local user.
CVSS v3.1 score: 5
GHSA-cx82-xv8x-vcx3 
Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter.
GHSA-m37x-3837-x5f2 
A vulnerability was detected in Edimax BR-6675nD 1.12. This vulnerability affects the function formsetPPPoE of the file /goform/formsetPPPoE of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 7.4
CVSS v3.1 score: 8.8
CVE-2026-55699 pnpm: reserved bin name deletes PNPM_HOME during global remove
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's bin-name guard. When a malicious package was installed globally, later global remove, update, or add-replacement flows could re-derive those names from the installed manifest and pass path.join(globalBinDir, binName) to removeBin. For "." this targets the global bin directory; for ".." this targets its parent. This vulnerability is fixed in 10.34.2 and 11.5.3.
CVSS v3.1 score: 6.5
GHSA-p8xq-w277-c7pg 
A vulnerability has been found in Banhammer Plugin and classified as problematic. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-214042 is the identifier assigned to this vulnerability.
GHSA-3q77-54x6-434x 
Secure Boot Security Feature Bypass Vulnerability
CVSS v3.1 score: 8
CVE-2021-1953 
Improper handling of received malformed FTMR request frame can lead to reachable assertion while responding with FTM1 frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS v3.1 score: 7.5
CVE-2022-43085 
An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS v3.1 score: 7.2
CVE-2021-42129 
A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
GHSA-3grx-qfww-j73p 
The fragment_set_tot_len function in epan/reassemble.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly determine the length of a reassembled packet for the DTLS dissector, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVE-2026-3516 Contact List <= 3.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter
The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to, and including, 3.0.18. This is due to insufficient input sanitization and output escaping when handling the Google Maps iframe custom field. The saveCustomFields() function in class-contact-list-custom-fields.php uses a regex to extract <iframe> tags from user input but does not validate or sanitize the iframe's attributes, allowing event handlers like 'onload' to be included. The extracted iframe HTML is stored via update_post_meta() and later rendered on the front-end in class-cl-public-card.php without any escaping or wp_kses filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
RHBA-2007:0026 Red Hat Bug Fix Advisory: htdig bug fix update
security flaw
RHSA-2020:4156 Red Hat Security Advisory: thunderbird security update
Mozilla: Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3 Mozilla: XSS when pasting attacker-controlled data into a contenteditable element Mozilla: Download origin spoofing via redirect Mozilla: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario
CVSS v3.1 score: 8.8
CVSS v3.0 score: 6.1
GHSA-25qx-mh3v-fxhh 
When using the Grafana Snowflake Datasource Plugin,
if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it  could result inthe wrong user identifier being used, and information for which the viewer is not authorized being returned.This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.
CVSS v4.0 score: 2.1
CVE-2015-4521 
The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
CVSS v2.0 score: 7.5
CVE-2011-0049 
Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.
CVSS v2.0 score: 5
CVE-2025-13946 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service
CVSS v3.1 score: 5.5
GHSA-xvr7-xmmp-p9vr 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Classified Listing allows Reflected XSS. This issue affects Classified Listing: from n/a through 4.0.1.
CVSS v3.1 score: 7.1
CVE-2019-20075 
On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
GHSA-gprg-q8r6-84hw 
** DISPUTED ** An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3_decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a contract violation, and thus the report is invalid.
CVSS v3.1 score: 6.5
CVE-2023-2912 SiteManager Embedded service disruption
Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction.
CVSS v3.1 score: 5.9
CVE-2023-42112 PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files.
The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22146.
CVSS v3.0 score: 3.3
GHSA-jp8m-f627-fcx7 
Insecure method vulnerability in the Versalsoft HTTP Image Uploader ActiveX control (UUploaderSvrD.dll 6.0.0.35) allows remote attackers to delete arbitrary files via the RemoveFileOrDir method.
CVE-2022-20302 
In Settings, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if the attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-200746457
CVSS v3.1 score: 7.6
CVE-2023-43263 
A Cross-site scripting (XSS) vulnerability in Froala Editor v.4.1.1 allows attackers to execute arbitrary code via the Markdown component.
CVSS v3.1 score: 6.1
CVE-2024-46625 
An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary code via uploading a crafted SVG file.
CVSS v3.1 score: 8.8
GHSA-4pc7-f2vc-2rv4 
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial of service against the server. IBM X-Force ID: 179476.
CVE-2021-44705 Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code execution
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-4369-mg8x-jq9f 
An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows an authenticated 'guest' user to perform unauthorized administrative actions, such as accessing the 'add user' feature, by bypassing client-side access controls.
CVSS v3.1 score: 8.8
GHSA-wmpg-v67v-chwf 
Stack overflow in custom XML-parser in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service.
CVSS v3.0 score: 7.5
CVE-2019-25709 CF Image Hosting Script 1.6.5 Unauthorized Database Access
CF Image Hosting Script 1.6.5 allows unauthenticated attackers to download and decode the application database by accessing the imgdb.db file in the upload/data directory. Attackers can extract delete IDs stored in plaintext from the deserialized database and use them to delete all pictures via the d parameter.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
GHSA-jr6g-mp22-2pf7 
IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVE-2020-11622 
A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M to 4.21.9M releases in the 4.21.x train, 4.21.3FX-7368.*, 4.21.4-FCRFX.*, 4.21.4.1, 4.21.7.1, 4.22.2.0.1, 4.22.2.2.1, 4.22.3.1, and 4.23.2.1 Router code in a scenario where TCP MSS options are configured.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 4.3
CVE-2018-0096 
A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to a failure to properly enforce RBAC for virtual domains. An attacker could exploit this vulnerability by sending an authenticated, crafted HTTP request to a targeted application. An exploit could allow the attacker to bypass RBAC policies on the targeted system to modify a virtual domain and access resources that are not normally accessible. Cisco Bug IDs: CSCvg36875.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.9
GHSA-vf2j-2h9w-44v2 
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, asynchronous callbacks received a pointer to a callers local variable. Should the caller return early (e.g., timeout), the callback will dereference an invalid pointer.
CVSS v3.0 score: 7.8
GHSA-gf66-v569-23vx 
eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.
CVSS v3.1 score: 9.8
CVE-2024-9570 D-Link DIR-619L B1 formEasySetTimezone buffer overflow
A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform/formEasySetTimezone. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
GHSA-6fmv-q269-55cw Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0
baserCMS 4.4.0 and earlier is affected by Remote Code Execution (RCE).Impact: XSS via Arbitrary script execution.
Attack vector is: Administrator must be logged in.
Components are: Edit template.
Tested baserCMS Version : 4.4.0 (Latest)
Affected baserCMS Version : 4.0.0 ~ 4.4.0
Patches : https://basercms.net/security/20201029
Found by Aquilao Null
CVSS v3.1 score: 7.2
PYSEC-2026-1690 
The servicenow config URL is using a generic django View with no authentication.

URL: `/plugins/ssot/servicenow/config/`

### Impact
_What kind of vulnerability is it? Who is impacted?_
An Unauthenticated attacker could access this page to view the Service Now public instance name e.g. `companyname.service-now.com`. This is considered **low-value information**.  This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change the instance name, nor set a Secret. There is not a way to gain access to other pages Nautobot through the unauthenticated Configuration page.

### Patches
_Has the problem been patched? What versions should users upgrade to?_
We highly recommend upgrading to SSoT v3.10.0 which includes this patch.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Disable the servicenow SSoT integration
CVSS v3.1 score: 5.3
GHSA-mrqj-9348-x8h5 
CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe.
CVSS v3.1 score: 7.8
CVE-2026-4694 Incorrect boundary conditions, integer overflow in the Graphics component
Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVSS v3.1 score: 7.5
CVE-2016-7534 
The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
GHSA-hcjq-w989-8v62 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farmakom Remote Administration Console allows SQL Injection.This issue affects Remote Administration Console: before 1.02.
CVSS v3.1 score: 9.8
GHSA-xv7x-x6wr-xx7g Apache Ranger policy engine incorrectly matches paths in certain conditions
Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.
CVSS v3.0 score: 5.9
CVE-2026-24181 
NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
CVSS v3.1 score: 7.3
GHSA-hm8r-95g3-5hj9 phpMyFAQ Stored Cross-site Scripting at File Attachments
SummaryAn attacker with admin privileges can upload an attachment containing JS code without extension and the application will render it as HTML which allows for XSS attacks.DetailsWhen attachments are uploaded without an extension, the application renders it as HTML by default. Therefore allowing attackers to upload .html files containing javascript code to perform XSS attacks. The direct file path to the uploaded attachment is also easily obtainable as it is made up of substrings of the file's MD5 hashes.PoCAdmin users can upload attachments containing XSS payloads in files without extensions to bypass the .html extension check.
![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/5c3c4222-550e-44c7-95ee-fd85562fffd5)Since the path of the uploaded file is built entirely on the file’s MD5 hash and the attachment directory, it is possible for an attacker to know the direct path of the uploaded file.E.g file MD5 hash: 38fff51cb7248a06d6142c6bdf846831Even though the attachment was uploaded without a file extension, it is still rendered as .html, hence triggering the XSS payload.
![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/663954ec-0210-4788-a841-7daa3fb547c3)ImpactThis allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session.
CVSS v3.1 score: 4.3
CVE-2025-59402 
Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls.
CVSS v3.1 score: 5.4
CVE-2021-45597 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVSS v3.1 score: 8.4
GHSA-mg54-7h26-f533 
NetApp OnCommand System Manager 8.3.x before 8.3.2P5 allows remote authenticated users to cause a denial of service via unspecified vectors.
CVSS v3.0 score: 6.5
CVE-2016-6824 
Huawei AC6003, AC6005, AC6605, and ACU2 access controllers with software before V200R006C10SPC200 allows remote authenticated users to cause a denial of service (device restart) via crafted CAPWAP packets.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 6.8
GHSA-5gvq-hx53-c65m 
Unspecified vulnerability in the Siebel Core - UIF Server component in Oracle Siebel CRM 8.0.0 and 8.1.1 allows remote authenticated users to affect confidentiality via unknown vectors related to User Interface.
GHSA-f5wh-3c43-vf4p 
In several native functions called by AdvertiseManager.java, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege in the Bluetooth server with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-171400004
GHSA-6vc5-v7hw-h5h2 Cross-site Scripting in RosarioSIS
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.
CVSS v3.1 score: 6.1
CVE-2023-32501 WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.6.1 versions.
CVSS v3.1 score: 4.3
GHSA-q3mx-v284-x6qr 
named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.
CVE-2023-49042 
Heap Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the schedStartTime parameter or the schedEndTime parameter in the function setSchedWifi.
CVSS v3.1 score: 9.8
CVE-2019-15897 
beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata server (which is typically not exposed to external networks).
CVSS v3.1 score: 9.6
CVSS v2.0 score: 8.3
CVE-2019-14328 
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
CVE-2025-57681 
The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. The vulnerability is exploited via a specially crafted payload placed in an issue's summary field
CVSS v3.1 score: 5.4
CVE-2015-9025 
In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a QTEE application.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
CVE-2013-4547 
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.
CVSS v2.0 score: 7.5
CVE-2025-24516 
Improper access control for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVSS v4.0 score: 6.8
CVSS v3.1 score: 4.5
CVE-2024-12027 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions
The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFilter() and deleteFilter() functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update and delete filters.
CVSS v3.1 score: 4.3
GHSA-7r3c-3rhp-45ch 
Use-after-free vulnerability in Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted calculatedColumnFormula object in an Office document, aka "Microsoft Office Memory Corruption Vulnerability."
GHSA-qhcw-x4hm-xwrx 
A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
CVSS v3.1 score: 6.8
CVE-2023-21784 3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
CVSS v3.1 score: 7.8
CVE-2025-11219 
Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1 score: 3.1
CVE-2009-4992 
SQL injection vulnerability in paidbanner.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS v2.0 score: 7.5
GHSA-7j5w-vxpg-45wv 
Windows Graphics Component Information Disclosure Vulnerability.
CVSS v3.1 score: 5.5
GHSA-8f2v-6436-599m 
Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.
CVE-2024-26606 binder: signal epoll threads of self-work
In the Linux kernel, the following vulnerability has been resolved:

binder: signal epoll threads of self-work

In (e)poll mode, threads often depend on I/O events to determine when
data is ready for consumption. Within binder, a thread may initiate a
command via BINDER_WRITE_READ without a read buffer and then make use
of epoll_wait() or similar to consume any responses afterwards.

It is then crucial that epoll threads are signaled via wakeup when they
queue their own work. Otherwise, they risk waiting indefinitely for an
event leaving their work unhandled. What is worse, subsequent commands
won't trigger a wakeup either as the thread has pending work.
CVSS v3.1 score: 5.5
GHSA-fwcg-wgp8-qrmr 
xscreensaver in Sun Solaris 10 before 20070604, when a GNOME session with Assistive Technology support is running, allows attackers with physical access to take control of the session after entering an Alt-Tab sequence.
RHSA-2017:2728 Red Hat Security Advisory: postgresql security update
postgresql: Empty password accepted in some authentication methods postgresql: pg_user_mappings view discloses passwords to users lacking server privileges
CVSS v3.0 score: 7.5
GHSA-6crj-q373-qxrw 
The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce validation on the plugin_toolbar_comparte page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1 score: 8.8
CVE-2016-9720 
IBM QRadar 7.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM Reference #: 1999533.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
GHSA-rhpc-22qh-75f4 
An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /lib/cste_modules/wireless.so.
CVSS v3.1 score: 9.8
GHSA-5966-596h-6mf4 
An issue was discovered in Bento4 1.5.1-627. There is an attempt at excessive memory allocation in the AP4_DataBuffer class when called from AP4_HvccAtom::Create in Core/Ap4HvccAtom.cpp.
CVSS v3.0 score: 6.5
CVE-2019-1003094 
Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
CVE-2026-50268 Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting selects PKCS#1 v1.5, which is the same algorithm as the `DEFAULT` setting. Steeltoe.Configuration.Encryption version 4.2.0 patches the issue.
CVSS v3.1 score: 1.9
CVE-2024-11427 Catch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Catch Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catch-popup' shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-h9gr-qpr9-596f 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, the DIAG-EFS command EFS2_DIAG_DELTREE, which is handled by the function fs_diag_deltree_handler(), is used to delete files and directories only inside the /public folder.
CVSS v3.0 score: 7.5
CVE-2012-5497 
membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.
CVSS v2.0 score: 5
CVE-2010-4915 
SQL injection vulnerability in index.cfm in ColdGen ColdBookmarks 1.22 allows remote attackers to execute arbitrary SQL commands via the BookmarkID parameter in an EditBookmark action.
CVSS v2.0 score: 7.5
GHSA-6w8f-96qc-82f7 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
RHSA-2023:4167 Red Hat Security Advisory: java-1.8.0-openjdk security update
OpenJDK: array indexing integer overflow issue (8304468) OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312)
CVSS v3.1 score: 3.7
GHSA-6mxq-x623-25h9 
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.
CVSS v3.1 score: 6
CVE-2026-53364 Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()

hci_le_big_terminate() allocates iso_list_data via kzalloc_obj but
returns 0 without freeing it when neither pa_sync_term nor big_sync_term
flags are set after evaluating the PA and BIG sync connection state.

This early-return path was introduced when hci_le_big_terminate() was
refactored to take struct hci_conn instead of raw u8 parameters, adding
PA/BIG flag evaluation logic. The existing kfree() on hci_cmd_sync_queue
failure does not cover this path.
CVSS v3.1 score: 5.5
CVE-2018-0206 
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the web-based management interface to click a link that submits malicious input to the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvg74815.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
CVE-2017-5613 
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
GHSA-x88x-gr85-5gjj 
Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.
CVSS v3.1 score: 8.1
GHSA-4frh-rw8g-vq9h 
There is a Cross-Site Scripting(XSS) vulnerability in HUAWEI WS318n product when processing network settings. Due to insufficient validation of user input, a local authenticated attacker could exploit this vulnerability by injecting special characters. Successful exploit could cause certain information disclosure. Affected product versions include: WS318n-21 10.0.2.2, 10.0.2.5 and 10.0.2.6.
CVE-2025-52904 File Browser: Command Execution not Limited to Scope
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions of the web application on the 2.x branch, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities.
CVSS v3.1 score: 8
CVE-2014-5887 
The Yell Local Search (aka com.yell.launcher2) application 4.2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
CVE-2026-15432 Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.
CVSS v4.0 score: 8.2
GHSA-g82m-q2g7-55jc 
In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random.
CVSS v3.1 score: 9.8
CVE-2019-9352 
In libstagefright, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-124253062
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
GHSA-7wfc-4796-gmg5 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
SummaryZitadel is vulnerable to an unauthenticated, full-read SSRF vulnerability. An unauthenticated remote attacker can force Zitadel into making HTTP requests to arbitrary domains, including internal addresses. The server then returns the upstream response to the attacker, enabling data exfiltration from internal services.ImpactZITADEL Login UI (V2) was vulnerable to service URL manipulation through the x-zitadel-forward-host header. The service URL resolution logic treated the header as a trusted fallback for all deployments, including self-hosted instances. This allowed unauthenticated attacker to force the server to make outbound requests and read the responses, reaching internal services, exfiltrating data, and bypassing IP-based or network-segmentation controls.Affected VersionsSystems using the login UI (v2) and running one of the following versions are affected:**v4.x**: `4.0.0-rc.1` through `4.7.0`PatchesThe vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the x-zitadel-forward-host, resp. all forwarded headers against the instance domains and trusted domains. It's no longer used to route traffic to the Zitadel API.Before you upgrade, ensure that:the `ZITADEL_API_URL` is set and is pointing to your instance, resp. system in multi-instance deployments.the HTTP `host` (or a `x-forwarded-host`) is passed in your reverse proxy to the login UI.a `x-zitadel-instance-host` (or `x-zitadel-forward-host`) is set in your reverse for multi-instance deployments. If you're running a single instance solution, you don't need to take any actions.Fixed versions:4.x: Upgrade to >=[4.7.1](https://github.com/zitadel/zitadel/releases/tag/v4.7.1)WorkaroundsThe recommended solution is to update ZITADEL to a patched version.A ZITADEL fronting proxy can be configured to delete all `x-zitadel-forward-host` header values or set it to the requested host before sending requests to ZITADEL self-hosted environments.QuestionsIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)CreditsThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.
CVSS v3.1 score: 9.3
CVE-2006-0067 
SQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS v2.0 score: 7.5