Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-57247 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T17:23:19.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control implementation in whitelist management functions. The setColdWhiteList() and setSpecialAddress() functions in the base ERC20 contract are declared as public without proper access control modifiers, allowing any user to bypass transfer restrictions and manipulate special address settings. This enables unauthorized users to circumvent cold time transfer restrictions a
and manipulate special address settings. This enables unauthorized users to circumvent cold time transfer restrictions and potentially disrupt dividend distribution mechanisms, leading to privilege escalation and violation of the contract's intended tokenomics. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bscscan.com/address/0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2#code - https://github.com/RikkaLzw/CVE/blob/main/CVE_BATB-TOKEN.md
CVE ID: CVE-2025-57248 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T16:04:33.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the application crashes inside libmupdf.dll, specifically in the DataPool::has_data() function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sumatrapdfreader/sumatrapdf/issues/5035
CVE ID: CVE-2025-57254 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-01T20:04:52.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers to execute arbitrary SQL queries via the username and password POST parameters. The application fails to properly sanitize input before embedding it into SQL queries, leading to unauthorized access or potential data breaches. This can result in privilege escalation, account takeover, or exposure of sensitive medical data. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
account takeover, or exposure of sensitive medical data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Karthikg1908/Hospital-Management-System - https://github.com/ischyr/research-and-development/tree/main/CVE-2025-57254
CVE ID: CVE-2025-57263 State: PUBLISHED Published: 2025-09-04T00:00:00.000Z Last Updated: 2025-09-04T15:04:26.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin access to inject malicious SQL payloads via the "word" POST parameter in the words.php admin panel. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstorm.news/files/id/207781/
CVE ID: CVE-2025-57266 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-09-29T20:39:21.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers to gain sensitive information such as API Keys via the /api/assistant/list endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LiuYuYang01/ThriveX-Server/issues/55 - https://gist.github.com/candyb0x/fccc49a989473b7f1e47479619eaf1ca
CVE ID: CVE-2025-57275 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-21T20:09:47.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spdk.io/ - https://github.com/spdk/spdk/commit/f786c6d75f5c5162363a621b24f5449c729679c9
CVE ID: CVE-2025-57278 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-22T15:36:12.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800_B10_ALK_SL_V01.01.02P42U14_06 does not implement proper session handling. After a user authenticates from a specific IP address, the router grants access to any other client using that same IP, without requiring credentials or verifying client identity. There are no session tokens, cookies, or unique identifiers in place. This flaw allows an attacker to obtain full administrative access simply by configuring their device to use the same IP address as a
ows an attacker to obtain full administrative access simply by configuring their device to use the same IP address as a previously authenticated user. This results in a complete authentication bypass. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lb-link.com/CPE300M-AX300-4G-LTE-Router-pd502775568.html - https://www.zyenra.com/blog/improper-ip-bound-session-authentication-in-lb-link-cpe300m
CVE ID: CVE-2025-57285 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T19:40:26.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.npmjs.com - https://gist.github.com/Dremig/1ba111f9b1f7cffe1fcb4838b64e55b9
CVE ID: CVE-2025-57292 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-26T15:20:12.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/echoBRT/TodoistStoredXSS - https://github.com/ASencerK/TodoistStoredXSS
CVE ID: CVE-2025-57293 State: PUBLISHED Published: 2025-09-18T00:00:00.000Z Last Updated: 2025-09-19T14:08:26.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. The phy_interface parameter is not sanitized, allowing attackers to inject arbitrary commands via a POST request to /cgi-bin/mbox-config?method=SET&section=multi_pppoe. When the action parameter is set to "one_click_redial", the unsanitized phy_interface is used in a system() call, enabling execution of malicious commands. This can lead to unauthorized access to s
nterface is used in a system() call, enabling execution of malicious commands. This can lead to unauthorized access to sensitive files, execution of arbitrary code, or full device compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZZ2266/.github.io/blob/main/comfast/multi_pppoe.markdown
CVE ID: CVE-2025-57295 State: PUBLISHED Published: 2025-09-18T00:00:00.000Z Last Updated: 2025-09-19T14:19:38.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file. Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code e
face or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZZ2266/.github.io/blob/main/H3C/readme.md - https://www.h3c.com/cn/d_202504/2407151_30005_0.htm
CVE ID: CVE-2025-57296 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T17:58:17.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the sub_ADBC0 helper function concatenates these user-supplied values into nvram set system commands using doSystemCmd, without validating or sanitizing special characters (e.g., ;, ", #). An unauthenticated or authenticated attacker can exploit this by submitting a crafted POST request, leading to arbi
#). An unauthenticated or authenticated attacker can exploit this by submitting a crafted POST request, leading to arbitrary system command execution on the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tenda.com.cn/material/show/2681 - https://github.com/ZZ2266/.github.io/tree/main/Tenda - https://github.com/ZZ2266/.github.io/blob/main/Tenda/readme.md
CVE ID: CVE-2025-57305 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-02T19:29:29.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vitaracharts.com - https://www.mattz.io/posts/cve-2025-57305/
CVE ID: CVE-2025-57310 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-13T16:12:25.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/MMAKINGDOM/a6c2c8c70145cbea4e119525651e9a8d - https://github.com/MMAKINGDOM/CVE-2025-57310
CVE ID: CVE-2025-57317 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-25T18:49:15.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: apidoc-core is the core parser library to generate apidoc result following the apidoc-spec. A Prototype Pollution vulnerability in the preProcess function of apidoc-core versions thru 0.15.0 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/apidoc-core%400.15.0/index.js - https://
https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/apidoc-core%400.15.0/index.js - https://github.com/OrangeShieldInfos/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57317
CVE ID: CVE-2025-57318 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-25T15:24:35.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/csvjson%405.1.0/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57318
CVE ID: CVE-2025-57319 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-26T17:10:52.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. NOTE: the Supplier disputes this because the reporter only demonstrated access to properties by an internal utility function, and there is no means for achieving prototype pollution via the public AP
to properties by an internal utility function, and there is no means for achieving prototype pollution via the public API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/fast-redact%403.5.0/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57319 - https://github.com/davidmarkclements/fast-redact/issues/75
CVE ID: CVE-2025-57320 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-25T18:51:56.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/json-schema-editor-visual
: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/json-schema-editor-visual%401.1.1/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57320
CVE ID: CVE-2025-57321 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-26T17:57:19.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/magix-combine-ex%401.2.10/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollutio
ution/magix-combine-ex%401.2.10/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57321
CVE ID: CVE-2025-57323 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-24T20:20:12.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: mpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mp.addEventHandler function of mpregular version 0.2.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/mpregular%400.2.0/index.js
References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/mpregular%400.2.0/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57323
CVE ID: CVE-2025-57324 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-25T14:28:40.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse version 5.3.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/parse%405.3.0/index.js - https://github.com/Vu
://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/parse%405.3.0/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57324
CVE ID: CVE-2025-57325 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-26T17:58:06.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: rollbar is a package designed to effortlessly track and debug errors in JavaScript applications. This package includes advanced error tracking features and an intuitive interface to help you identify and fix issues more quickly. A Prototype Pollution vulnerability in the utility.set function of rollbar v2.26.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: R
ayload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/rollbar%402.26.4/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57325
CVE ID: CVE-2025-57326 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-26T17:57:49.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/sassdoc-extras%402.5.1/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57326
CVE ID: CVE-2025-57327 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-26T17:57:32.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: spmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc version 1.2.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/spmrc%401.2.0/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/
/PoCs/blob/main/JavaScript/prototype-pollution/spmrc%401.2.0/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57327
CVE ID: CVE-2025-57328 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-29T17:53:41.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objects. A Prototype Pollution vulnerability in the enable and disable function of toggle-array v1.0.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/toggle-array%401.0.1/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57328
CVE ID: CVE-2025-57329 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-26T17:58:39.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/web3-core-method%401.10.4/index.js
es: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/web3-core-method%401.10.4/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57329
CVE ID: CVE-2025-57330 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-29T17:56:26.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in the attachToObject function of web3-core-subscriptions version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/web3-core-subscriptions%401.10
erences: - https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/web3-core-subscriptions%401.10.4/index.js - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57330
CVE ID: CVE-2025-57347 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-26T17:58:52.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution vulnerabilities by injecting malicious input values (e.g., "__proto__"), enabling unauthorized modification of the JavaScript Object prototype chain. Successful exploitation could lead to denial of service conditions, unexpected application
ript Object prototype chain. Successful exploitation could lead to denial of service conditions, unexpected application behavior, or potential execution of arbitrary code in contexts where polluted properties are later accessed or executed. The issue affects versions prior to 7.0.11 and remains unpatched at the time of disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tbo47/dagre-es/issues/52 - https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57347
CVE ID: CVE-2025-57348 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-25T18:28:54.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allow an attacker to inject properties into the prototype of built-in objects. This issue, categorized under CWE-1321, arises from improper validation of user-supplied input in the package's resource initialization process. Successful exploitation may lead to denial of service or arbitrary code execution in affected environments. The vulnerability affects versions up to and including 5.0.