Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22592 State: PUBLISHED Published: 2025-01-07T14:57:01.186Z Last Updated: 2025-01-07T16:55:19.545Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenderd Products: 1003 Mortgage Application Problem Types: CWE-862 Description: Missing Authorization vulnerability in Lenderd 1003 Mortgage Application allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 1003 Mortgage Application: from n/a through 1.87. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/1003-mortgage-application/vulnerability/wordpress-1003-mortgage-application-plugin-1-87-broken-access-con
rdpress/plugin/1003-mortgage-application/vulnerability/wordpress-1003-mortgage-application-plugin-1-87-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-22593 State: PUBLISHED Published: 2025-01-07T14:57:00.481Z Last Updated: 2025-01-07T16:56:49.344Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Burria Products: Laika Pedigree Tree Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Burria Laika Pedigree Tree allows Stored XSS.This issue affects Laika Pedigree Tree: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/laika-pedigree-tree/vulnerability/wordpress-laika-pedigree-tree-plugin-1-4-csrf-to-stored-xss-vulnerability?_s
ss/plugin/laika-pedigree-tree/vulnerability/wordpress-laika-pedigree-tree-plugin-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22594 State: PUBLISHED Published: 2025-01-09T15:39:22.378Z Last Updated: 2025-01-10T20:41:35.184Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: hccoder – Sándor Fodor Products: Better User Shortcodes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder – Sándor Fodor Better User Shortcodes allows Reflected XSS.This issue affects Better User Shortcodes: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/better-user-shortcodes/vulnerability/wordpress-better-user-shortco
s: - https://patchstack.com/database/wordpress/plugin/better-user-shortcodes/vulnerability/wordpress-better-user-shortcodes-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22595 State: PUBLISHED Published: 2025-01-09T15:39:21.803Z Last Updated: 2025-01-10T20:41:43.634Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Yamna Khawaja Products: Mailing Group Listserv Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja Mailing Group Listserv allows Reflected XSS.This issue affects Mailing Group Listserv: from n/a through 2.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-mailing-group/vulnerability/wordpress-mailing-group-listserv-plugin-2-0-9-refle
chstack.com/database/wordpress/plugin/wp-mailing-group/vulnerability/wordpress-mailing-group-listserv-plugin-2-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22596 State: PUBLISHED Published: 2025-01-10T15:27:24.109Z Last Updated: 2025-01-10T16:04:32.764Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the modulos_visiveis.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jcj3-gqj3-rrvm
CVE ID: CVE-2025-22597 State: PUBLISHED Published: 2025-01-10T15:28:40.413Z Last Updated: 2025-08-26T19:42:25.857Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the CobrancaController.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the local_recepcao parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.
e server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mgj3-g922-2r9v
CVE ID: CVE-2025-22598 State: PUBLISHED Published: 2025-01-10T15:29:06.161Z Last Updated: 2025-08-26T19:41:57.006Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the cadastrarSocio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the local_recepcao parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Thi
rver and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9x2j-pw3h-p53f
CVE ID: CVE-2025-22599 State: PUBLISHED Published: 2025-01-10T15:29:46.506Z Last Updated: 2025-01-10T15:50:15.244Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the home.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-8354-6cxw-7g8c
CVE ID: CVE-2025-22600 State: PUBLISHED Published: 2025-01-10T15:30:15.534Z Last Updated: 2025-01-10T15:46:26.253Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_doacao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the avulso parameter. This vulnerability is fixed in 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v856-wjh3-4rhg
CVE ID: CVE-2025-22601 State: PUBLISHED Published: 2025-02-04T20:53:11.983Z Last Updated: 2025-02-11T21:32:19.520Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: discourse Products: discourse Problem Types: CWE-22 Description: Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the `activate-account` route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
e are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-gvpp-v7mp-wxxw
CVE ID: CVE-2025-22602 State: PUBLISHED Published: 2025-02-04T20:51:56.909Z Last Updated: 2025-02-12T14:03:25.855Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP. Additional Analyst Notes: - CISA ADP Vulnrichme
Users are advised to upgrade. Users unable to upgrade should enable CSP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-jcjx-694p-c5m3
CVE ID: CVE-2025-22603 State: PUBLISHED Published: 2025-03-10T18:09:51.419Z Last Updated: 2025-03-10T19:17:04.406Z Vendors: Significant-Gravitas Products: AutoGPT Problem Types: CWE-918 Description: AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior to autogpt-platform-beta-v0.4.2 contains a server-side request forgery (SSRF) vulnerability inside component (or block) `Send Web Request`. The root cause is that IPV6 address is not restricted or filtered, which allows attackers to perform a server side request forgery to visit an IPV6 service. autogpt-platform-beta-v0.4.2 fixes the issue
ttackers to perform a server side request forgery to visit an IPV6 service. autogpt-platform-beta-v0.4.2 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-4c8v-hwxc-2356 - https://github.com/Significant-Gravitas/AutoGPT/commit/26214e1b2c6777e0fae866642b23420adaadd6c4 - https://boatneck-faucet-cba.notion.site/SSRF-of-AutoGPT-153b650a4d88804d923ad65a015a7d61 - https://github.com/Significant-Gravitas/AutoGPT/blob/2121ffd06b26a438706bf642372cc46d81c94ddc/autogpt_platform/backend/backend/util/request.py#L11
CVE ID: CVE-2025-22604 State: PUBLISHED Published: 2025-01-27T17:06:58.215Z Last Updated: 2025-11-03T21:00:09.159Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Cacti Products: cacti Problem Types: CWE-78 Description: Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29. Additional Analyst
a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-c5j8-jxj3-hh36 - https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
CVE ID: CVE-2025-22605 State: PUBLISHED Published: 2025-01-24T14:54:18.707Z Last Updated: 2025-01-24T16:37:08.706Z Vendors: coollabsio Products: coolify Problem Types: CWE-78 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Starting in version 4.0.0-beta.18 and prior to 4.0.0-beta.253, a vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolify container, gaining access to data and private keys or tokens of other users/teams. The ability to inject malicious commands into the Coolify container gives authenticated attackers the ability to fully retrieve
lity to inject malicious commands into the Coolify container gives authenticated attackers the ability to fully retrieve and control the data and availability of the software. Centrally hosted Coolify instances (open registration and/or multiple teams with potentially untrustworthy users) are especially at risk, as sensitive data of all users and connected servers can be leaked by any user. Additionally, attackers are able to modify the running software, potentially deploying malicious images to remote nodes or generally changing its behavior. Version 4.0.0-beta.253 patches this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/secu
this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/security/advisories/GHSA-9wqm-fg79-4748 - https://github.com/coollabsio/coolify/pull/1524 - https://github.com/coollabsio/coolify/pull/1625 - https://github.com/coollabsio/coolify/commit/353245bb7de9680f238bae30443af1696bc977b0 - https://github.com/coollabsio/coolify/blob/40a239ddda3fc919f57a052d7b52b8e1a6696b81/bootstrap/helpers/remoteProcess.php#L70
CVE ID: CVE-2025-22606 State: PUBLISHED Published: 2025-01-24T15:38:47.352Z Last Updated: 2025-02-12T20:01:19.366Z Vendors: coollabsio Products: coolify Problem Types: CWE-78 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute a
e, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute arbitrary commands on the host server, which could result in full system compromise; create, modify, or delete sensitive system files; and escalate privileges depending on the permissions of the executed process. Attackers with access to project management features could exploit this flaw to gain unauthorized control over the host environment. Version 4.0.0-beta.359 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/security/advisories/GHSA-ccp8-v65g-m526
CVE ID: CVE-2025-22607 State: PUBLISHED Published: 2025-01-24T15:45:03.711Z Last Updated: 2025-01-24T15:58:23.987Z Vendors: coollabsio Products: coolify Problem Types: CWE-200, CWE-862 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UUID of the model. This exposes the "client id", "client secret" and "webhook secret." Version 4.0.0-beta.361 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github
Version 4.0.0-beta.361 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/security/advisories/GHSA-8w24-gfgq-jg72
CVE ID: CVE-2025-22608 State: PUBLISHED Published: 2025-01-24T16:28:51.398Z Last Updated: 2025-02-12T20:01:19.259Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: coollabsio Products: coolify Problem Types: CWE-639, CWE-862 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to revoke any team invitations on a Coolify instance by only providing a predictable and incrementing ID, resulting in a Denial-of-Service attack (DOS). Version 4.0.0-beta.361 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichme
Denial-of-Service attack (DOS). Version 4.0.0-beta.361 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/security/advisories/GHSA-qmxm-wvm9-wvxx
CVE ID: CVE-2025-22609 State: PUBLISHED Published: 2025-01-24T16:30:34.465Z Last Updated: 2025-02-12T20:01:19.146Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: coollabsio Products: coolify Problem Types: CWE-862 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` f
st likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` feature and execute arbitrary commands on the victim's server. Version 4.0.0-beta.361 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/security/advisories/GHSA-3w2c-jfr2-9pg9
CVE ID: CVE-2025-22610 State: PUBLISHED Published: 2025-01-24T16:33:17.058Z Last Updated: 2025-01-24T21:30:24.874Z Vendors: coollabsio Products: coolify Problem Types: CWE-862 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" for every custom OAuth provider. The attacker can also modify the global OAuth configuration. Version 4.0.0-beta.361 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.c
ersion 4.0.0-beta.361 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/security/advisories/GHSA-496v-9q38-2x6c
CVE ID: CVE-2025-22611 State: PUBLISHED Published: 2025-01-24T16:35:21.439Z Last Updated: 2025-01-24T21:31:29.529Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: coollabsio Products: coolify Problem Types: CWE-862 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able to kick every other member out of the team, including admins and owners. This allows the attacker to access the `Terminal` feature and execut
ember out of the team, including admins and owners. This allows the attacker to access the `Terminal` feature and execute remote commands. Version 4.0.0-beta.361 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/security/advisories/GHSA-9w72-9qww-qj6g
CVE ID: CVE-2025-22612 State: PUBLISHED Published: 2025-01-24T16:43:49.448Z Last Updated: 2025-02-12T20:01:19.036Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: coollabsio Products: coolify Problem Types: CWE-200, CWE-862 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can execute arbit
ort (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can execute arbitrary commands on the remote server. Version 4.0.0-beta.374 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/security/advisories/GHSA-wg8x-cgq4-vjxj
CVE ID: CVE-2025-22613 State: PUBLISHED Published: 2025-01-13T20:59:10.478Z Last Updated: 2025-01-14T00:31:18.399Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `informacao_adicional.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application
uted automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `informacao_adicional.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/
workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fhpx-54ch-ccxh - https://github.com/LabRedesCefetRJ/WeGIA/commit/d47412372d94dc3ca26e6416b8315895c61224fa
CVE ID: CVE-2025-22614 State: PUBLISHED Published: 2025-01-13T20:58:11.230Z Last Updated: 2025-01-14T15:57:13.758Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `dependente_editarInfoPessoal.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `nome` and `SobrenomeForm`parameters. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security
on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `dependente_editarInfoPessoal.php` parameters. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: R
to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-wr55-2952-79rh - https://github.com/LabRedesCefetRJ/WeGIA/commit/8eb446f132ceba002559da2fd8745386096d494e