ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2023-49930: An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted.
CVSS v3.1: 9.8
CVE-2021-41232: Improper Neutralization of Special Elements used in an LDAP Query
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.
CVSS v3.1: 8.1
CVE-2025-9943: Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider
An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).

This issue affects Shibboleth Service Provider through 3.5.0.
CVSS v3.1: 9.1
GHSA-6px2-f4fc-3m96: The sctp_getsockopt_hmac_ident function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, relies on an untrusted length value to limit copying of data from kernel memory, which allows local users to obtain sensitive information via a crafted SCTP_HMAC_IDENT IOCTL request involving the sctp_getsockopt function.
GHSA-69vv-8r9h-g8x5: A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability.
CVSS v3.1: 7.8
RHSA-2022:6450: Red Hat Security Advisory: ruby:3.0 security, bug fix, and enhancement update
ruby: Regular expression denial of service vulnerability of Date parsing methods ruby: Cookie prefix spoofing in CGI::Cookie.parse Ruby: Double free in Regexp compilation ruby: Buffer overrun in String-to-Float conversion
CVSS v3.1: 6.2
CVE-2021-47000: ceph: fix inode leak on getattr error in __fh_to_dentry
In the Linux kernel, the following vulnerability has been resolved:

ceph: fix inode leak on getattr error in __fh_to_dentry
CVSS v3.1: 3.3
GHSA-wxhc-3989-9jq8: In the Linux kernel, the following vulnerability has been resolved:media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()Fix an 11-year old bug in ngene_command_config_free_buf() while
addressing the following warnings caught with -Warray-bounds:arch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]
arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]The problem is that the original code is trying to copy 6 bytes of
data into a one-byte size member _config_ of the wrong structue
FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a
legitimate compiler warning because memcpy() overruns the length
of &com.cmd.ConfigureBuffers.config. It seems that the right
structure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains
6 more members apart from the header _hdr_. Also, the name of
the function ngene_command_config_free_buf() suggests that the actual
intention is to ConfigureFreeBuffers, instead of ConfigureBuffers
(which takes place in the function ngene_command_config_buf(), above).Fix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS
into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as
the destination address, instead of &com.cmd.ConfigureBuffers.config,
when calling memcpy().This also helps with the ongoing efforts to globally enable
-Warray-bounds and get us closer to being able to tighten the
FORTIFY_SOURCE routines on memcpy().
CVSS v3.1: 7.1
GHSA-vchr-52gm-9jgr: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2025-1361: IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function
The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the plugin's settings.
CVSS v3.1: 7.5
GHSA-3ghf-mqfr-9xvw: A vulnerability, which was classified as critical, was found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file manage_student.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226272.
CVSS v3.0: 6.3
CVE-2020-23702: Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
RHSA-2020:2419: Red Hat Security Advisory: unbound security update
unbound: amplification of an incoming query into a large number of queries directed to a target unbound: infinite loop via malformed DNS answers received from upstream servers
CVSS v3.1: 7.5
CVE-2025-2811: GL.iNet GL-A1300 Slate Plus API redos
A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component.
CVSS v4.0: 6.9
CVSS v3.1: 5.7
CVSS v3.0: 5.7
CVSS v2.0: 5.5
GHSA-wqcw-jp7x-gc3r: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store allows DOM-Based XSS. This issue affects Ebook Store: from n/a through 5.8007.
CVSS v3.1: 6.5
GHSA-wp53-j4wj-2cfg: Python-Multipart has Arbitrary File Write via Non-Default Configuration
SummaryA Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename.DetailsWhen `UPLOAD_DIR` is set and `UPLOAD_KEEP_FILENAME` is `True`, the library constructs the file path using `os.path.join(file_dir, fname)`. Due to the behavior of `os.path.join()`, if the filename begins with a `/`, all preceding path components are discarded:This allows an attacker to bypass the intended upload directory and write files to arbitrary paths.Affected ConfigurationProjects are only affected if all of the following are true:`UPLOAD_DIR` is set`UPLOAD_KEEP_FILENAME` is set to TrueThe uploaded file exceeds `MAX_MEMORY_FILE_SIZE` (triggering a flush to disk)The default configuration is not vulnerable.ImpactArbitrary file write to attacker-controlled paths on the filesystem.MitigationUpgrade to version 0.0.22, or avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
CVSS v3.1: 8.6
CVE-2022-2557: WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion
The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user
CVSS v3.1: 8.8
GHSA-65fm-2jgr-j7qq: memos vulnerable to Server-Side Request Forgery in /api/resource
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the `/api/resource` that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file.
CVSS v4.0: 6.9
CVSS v3.1: 5.8
CVE-2025-8886: Authorization Bypass in Usta Information Systems' Aybs Interaktif
Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorization vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Privilege Abuse, Authentication Bypass.

This issue affects Aybs Interaktif: from 2024 through 28082025.
CVSS v3.1: 6.7
GHSA-qghf-f6j3-538m: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
GHSA-pfhj-qj49-rfqg: Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS v3.0: 6.5
CVE-2019-19297: A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The streaming service (default port 5410/tcp) of the SiVMS/SiNVR Video Server
contains a path traversal vulnerability, that could allow an
unauthenticated remote attacker to access and download arbitrary files from the server.
CVSS v3.1: 7.5
CVE-2019-10185: It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
CVSS v3.0: 8.2
GHSA-2cx2-wv26-jp38: Multiple buffer overflows in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors.
GHSA-gqvr-q8fg-26rw: psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion.
CVSS v3.0: 7.8
CVE-2017-16542: Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
GHSA-2jp9-cpg6-cxq3: In apexd, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-147002540
RHSA-2025:8057: Red Hat Security Advisory: kernel-rt security update
kernel: net/mlx5: Always stop health timer during driver removal kernel: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink kernel: vsock: Keep the binding until socket destruction
CVSS v3.1: 7.8
GHSA-5w95-m5g4-hrhx: Heap-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a spreadsheet containing a malformed Binary File Format (aka BIFF) record that triggers memory corruption, aka "Excel Document Parsing Heap Overflow Vulnerability."
GHSA-7vx7-4r5w-mwxw: sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.
GHSA-4255-c27h-62m5: unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)
The sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the `--verbose` flag is used. Command-line arguments including `--email` and `--password` are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems.Users who run sign-package with `--verbose` and credential arguments expose their Unity account passwords. This affects all versions prior to 1.8.2. The vulnerability requires explicit user action (using `--verbose`) but creates significant risk in automated and shared environments.Workaround: Use environment variables (`UNITY_USERNAME`, `UNITY_PASSWORD`) instead of command-line arguments, and avoid the `--verbose` flag when working with credentials.Existing RageAgainstThePixel and Buildalon GitHub actions are unaffected as they use the environment variables exclusively.
CVSS v4.0: 5.9
CVE-2014-4278: Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Oracle Forms.
CVSS v2.0: 7.5
CVE-2016-8237: Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.
CVSS v3.0: 8.1
CVSS v2.0: 9.3
CVE-2020-23161: Local file inclusion in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to traverse directories and read sensitive files via the Maintenance > Logs menu and manipulating the file-path in the URL.
CVSS v3.1: 6.5
CVSS v2.0: 4
GHSA-mm4c-xxvm-cv5j: The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.8
GHSA-vj22-mh53-pp5f: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Feed allows Stored XSS. This issue affects HT Feed: from n/a through 1.3.0.
CVSS v3.1: 6.5
GHSA-x5jq-pghc-5j6p: SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded value of the admin parameter to shop/admin.php.
GHSA-77gw-gm6r-6m2p: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2016-9950: An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-f8g9-2rhq-m53g: Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=.
CVSS v3.1: 9.8
CVE-2009-4335: Multiple unspecified vulnerabilities in bundled stored procedures in the Spatial Extender component in IBM DB2 9.5 before FP5 have unknown impact and remote attack vectors, related to "remote exploits."
CVSS v2.0: 10
GHSA-9hcm-hr65-2825: mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid login credentials based on the server's response time, potentially leading to unauthorized access.
CVSS v3.0: 7.5
GHSA-792m-27mh-cxj5: The BackUpWordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.13 via the hmbkp_directory_browse parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to traverse directories outside of the context in which the plugin should allow.
CVSS v3.1: 2.7
GHSA-hf8v-4h5p-jj4q: Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access Technology BLU-IC4 allows Flooding.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS v4.0: 10
CVSS v3.1: 9.8
GHSA-f5cq-p3m3-57vm: Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/SetVirtualServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVSS v3.1: 7.5
CVE-2009-1179: Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.
CVSS v2.0: 6.8
GHSA-9j8q-r68h-7xw4: A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/?page=product/manage_product&id=2. The manipulation of the argument Product Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224996.
CVSS v3.1: 6.1
CVE-2026-6169: affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution
The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and executes it via eval() without sanitization or sandboxing. This makes it possible for authenticated attackers, with Editor-level access and above, to execute arbitrary code on the server by injecting PHP into a plugin template.
CVSS v3.1: 7.2
GHSA-2x59-2w3w-3ccw: A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of the component Roles Page. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be exploited.
CVSS v4.0: 1.9
CVSS v3.1: 2.4
GHSA-rqpg-32gg-fvxh: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30430, Acronis Cyber Protect 15 (Windows) before build 30984.
CVSS v3.0: 7.3
CVE-2008-7070: Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a " (quote) followed by command line switches in a (1) irc:///, (2) irc6:///, (3) ircs:///, or (4) and ircs6:/// URI.  NOTE: this might be due to an incomplete fix for CVE-2007-2951.
CVSS v2.0: 9.3
CVE-2023-3148: SourceCodester Online Discussion Forum Site manage_post.php sql injection
A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0 and classified as critical. This issue affects some unknown processing of the file admin\posts\manage_post.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231017 was assigned to this vulnerability.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-45ff-x9p5-mq3g: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets
This could allow an attacker to render the service unavailable and cause denial-of-service conditions by overwhelming system resources.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-2924-xwpv-8gcj: IBM API Connect 5.0.0.0 through 5.0.8.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 142430.
CVSS v3.0: 4.3
GHSA-9m3q-rhmv-5q44: Out-of-bounds Read in Ruby JSON Parser
ImpactA specially crafted document could cause an out of bound read, most likely resulting in a crash.Versions 2.10.0 and 2.10.1 are impacted. Older versions are not.PatchesVersion 2.10.2 fixes the problem.WorkaroundsNone.
CVSS v3.1: 7.5
CVE-2022-41432: EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/report_event/index.php.
CVSS v3.1: 4.8
CVE-2012-6634: wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value.
CVSS v2.0: 6.4
ICSA-20-191-02: Rockwell Automation Logix Designer Studio 5000
The affected product is vulnerable to an xml external entity (XXE) vulnerability, which may allow an attacker to view hostnames or other resources from the program.CVE-2020-12025 has been assigned to this vulnerability. A CVSS v3 base score of 3.6 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).
CVSS v3.0: 3.6
CVE-2017-5930: The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
CVSS v3.1: 2.7
CVSS v2.0: 3.5
CVE-2018-4383: A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2022-35287: IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 230817.
CVSS v3.0: 6.8
GHSA-pw9j-qgmc-g62h: The Appointment Booking Calendar Plugin and Scheduling Plugin  WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist).
CVSS v3.1: 7.5
GHSA-m44g-hq47-38xw: In the Linux kernel, the following vulnerability has been resolved:drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()Nouveau is mostly designed in a way that it's expected that fences only
ever get signaled through nouveau_fence_signal(). However, in at least
one other place, nouveau_fence_done(), can signal fences, too. If that
happens (race) a signaled fence remains in the pending list for a while,
until it gets removed by nouveau_fence_update().Should nouveau_fence_context_kill() run in the meantime, this would be
a bug because the function would attempt to set an error code on an
already signaled fence.Have nouveau_fence_context_kill() check for a fence being signaled.
CVSS v3.1: 5.5
CVE-2010-2048: Multiple cross-site scripting (XSS) vulnerabilities in the Heartbeat module 6.x before 6.x-4.9 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 3.5
CVE-2025-52772: WordPress Virtual Moderator plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Adnan Haque (a11n) Virtual Moderator allows Cross-Site Scripting (XSS). This issue affects Virtual Moderator: from n/a through 1.4.
CVSS v3.1: 7.1