ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-c3qq-7mg6-6r2x: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_422880 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS v3.1: 7.5
GHSA-cr92-mg8v-7vg4: A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
CVSS v3.1: 8.8
GHSA-69fc-v223-6rjw: Duplicate Advisory: Pimcore Cross-site scripting in Predefined Asset Metadata module in Settings
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of [GHSA-6qjm-39vh-729w](https://github.com/advisories/GHSA-6qjm-39vh-729w). This link is maintained ot preserve external references.Original DescriptionCross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
GHSA-cx3j-qqxj-9597: Critters Cross-site Scripting Vulnerability
ImpactCritters version 0.0.17-0.0.19 have an issue when parsing the HTML which leads to a potential [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) bug.PatchesThe bug has been fixed in `v0.0.20`.WorkaroundsUpgrading Critters version to `>0.0.20` is the easiest fix. This is a non breaking version upgrade so we recommend all users to use `v0.0.20`.
CVSS v3.1: 6.1
CVE-2025-59933: libvips is vulnerable to Buffer Over-Read in poppler-based pdfload
libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines a width but not a height. Those using libvips compiled without support for PDF input are unaffected as well as thosewith support for PDF input via PDFium. This issue is fixed in version 8.17.2. A workaround for those affected is to block the VipsForeignLoadPdf operation via vips_operation_block_set, which is available in most language bindings, or to set VIPS_BLOCK_UNTRUSTED environment variable at runtime, which will block all untrusted loaders including PDF input via poppler.
CVSS v4.0: 5.1
CVE-2020-24057: The management website of the Verint S5120FD Verint_FW_0_42 unit features a CGI endpoint ('ipfilter.cgi') that allows the user to manage network filtering on the unit. This endpoint is vulnerable to a command injection. An authenticated attacker can leverage this issue to execute arbitrary commands as 'root'.
CVSS v3.1: 8.8
CVSS v2.0: 9
GHSA-r9hg-f94w-656h: An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.
CVSS v3.1: 6.5
CVE-2025-30103: Dell SmartFabric OS10 Software, versions prior to 10.6.0.5 contains a Files or Directories Accessible to External Parties vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
CVSS v3.1: 5.5
CVE-2018-21131: Certain NETGEAR devices are affected by unauthenticated firmware downgrade. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.
CVSS v3.0: 8.1
RHSA-2022:8680: Red Hat Security Advisory: 389-ds:1.4 security update
389-ds-base: SIGSEGV in sync_repl
CVSS v3.1: 6.5
RHSA-2026:3987: Red Hat Security Advisory: kpatch-patch-5_14_0-611_9_1 security update
kernel: Linux kernel: vsock vulnerability may lead to memory corruption
CVSS v3.1: 7
CVE-2026-1189: LeadBI Plugin for WordPress <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute
The LeadBI Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter of the 'leadbi_form' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-3737-xm99-hq62: Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without proper authorization.
CVSS v3.1: 4.3
CVE-2024-52701: A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter.
CVSS v3.1: 5.4
GHSA-ch56-mgr4-g3m4: A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.
CVSS v3.1: 7.8
RHSA-2025:1325: Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release
golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
CVSS v3.1: 8.2
GHSA-q5g2-cvmv-mgqh: IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.1: 6.4
CVE-2015-8777: The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.
CVSS v3.0: 5.5
CVSS v2.0: 2.1
GHSA-gm9p-3w2c-c6qg: In the Linux kernel, the following vulnerability has been resolved:accel/ivpu: Add bounds checks for firmware log indicesAdd validation that read and write indices in the firmware log buffer
are within valid bounds (< data_size) before using them. If
out-of-bounds indices are encountered (from firmware), clamp them to
safe values instead of proceeding with invalid offsets.This prevents potential out-of-bounds buffer access when firmware
supplies invalid log indices.
CVSS v3.1: 7.1
GHSA-f3jx-26gh-ppcx: The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.
GHSA-rm3f-295w-c3mc: IBM i Access Family 1.1.5.0 through 1.1.9.12 IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator.
CVSS v3.1: 8.8
CVE-2023-48296: OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID
OroPlatform is a PHP Business Application Platform (BAP).  Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.

CVSS v3.1: 4.3
GHSA-jg4h-m674-ch4q: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. This vulnerability is triggered via sending a crafted .yaml file.
CVSS v3.1: 9.8
CVE-2021-21738: ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, the attacker could implement XSS attacks by tampering with the parameters, to affect the operations of valid users. This affects: <ZXIPTV><ZXIPTV-EAS_PV5.06.04.09>
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2023-25691: Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution
Improper Input Validation vulnerability in the Apache Airflow Google Provider.

This issue affects Apache Airflow Google Provider versions before 8.10.0.


CVSS v3.1: 9.8
GHSA-v79h-64cf-gw4x: Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.
CVSS v3.1: 6.7
CVE-2009-0650: Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 and earlier, and possibly 5.02, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a STATS line with a long pwd field.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 10
GHSA-mg62-cr67-wx99: In ImageMagick 7.0.5-5, the ReadBMPImage function in bmp.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS v3.0: 6.5
GHSA-2799-6g5r-mmc7: Superduper: Remote code execution via unsafe eval in superduper query parsing
The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although the function attempts to limit the execution context by providing a restricted global namespace, it does not block access to dangerous built-in functions. A remote attacker can exploit this by submitting a specially crafted query string containing Python code that imports modules (e.g., os) and executes arbitrary system commands, leading to complete compromise of the server.
CVSS v3.1: 8.8
CVE-2026-20929: Windows HTTP.sys Elevation of Privilege Vulnerability
Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.
CVSS v3.1: 7.5
CVE-2009-2113: Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to player.php and the (2) hash parameter to song.php.
CVSS v2.0: 7.5
CVE-2026-13544: Feehi CMS API users access control
A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2024-13265: Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
CVSS v3.1: 7.5
GHSA-7x7f-m8j9-p3cw: In the Linux kernel, the following vulnerability has been resolved:wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()In ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different
radio, it gets deleted from that radio through a call to
ath12k_mac_unassign_link_vif(). This action frees the arvif pointer.
Subsequently, there is a check involving arvif, which will result in a
read-after-free scenario.Fix this by moving this check after arvif is again assigned via call to
ath12k_mac_assign_link_vif().Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
CVSS v3.1: 7.8
CVE-2015-3813: The fragment_add_work function in epan/reassemble.c in the packet-reassembly feature in Wireshark 1.12.x before 1.12.5 does not properly determine the defragmentation state in a case of an insufficient snapshot length, which allows remote attackers to cause a denial of service (memory consumption) via a crafted packet.
CVSS v2.0: 5
CVE-2025-14067: Easy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure
The Easy Form Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive form response data, including messages, admin replies, and user information due to a logic error in the authorization check that uses AND (&&) instead of OR (||).
CVSS v3.1: 5.3
CVE-2021-39201: Authenticated cross-site scripting (XSS) in WordPress editor
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)
CVSS v3.1: 7.6
GHSA-v8xg-3gv8-m4wc: The Alfie – Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_manage() function which handles feed deletion via the 'delete' GET parameter. This makes it possible for unauthenticated attackers to delete arbitrary plugin feed data (from alfie_colindex, alfie_producten, alfie_reactions, and alfie_searchproduct tables) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
GHSA-j824-jv3m-j84m: Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.
CVSS v3.0: 8.8
GHSA-wpfj-9q2g-67mp: In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uri, or response), only the last instance can ever be freed.
CVSS v3.0: 7.5
GHSA-9mxr-w23m-77x3: Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
GHSA-4588-3gxf-rhp2: Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack.
RHSA-2017:2841: Red Hat Security Advisory: dnsmasq security update
dnsmasq: heap overflow in the code responsible for building DNS replies
CVSS v3.0: 9.8
CVE-2024-0290: Kashipara Food Management System stock_edit.php sql injection
A vulnerability, which was classified as critical, has been found in Kashipara Food Management System 1.0. This issue affects some unknown processing of the file stock_edit.php. The manipulation of the argument item_type leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249851.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-gpxj-9prg-35ww: An Improper Handling of Unicode Encoding vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator.See Instruction Manual Appendix A and Appendix E dated 20230615 for more details.
This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.
CVSS v3.1: 4.8
CVE-2024-54767: An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. NOTE: this is disputed by the Supplier because it cannot be reproduced, and the issue report focuses on an unintended configuration with direct Internet exposure.
CVSS v3.1: 7.5
CVE-2022-40218: WordPress TH Advance Product Search plugin <= 1.1.4 - Unauthenticated Plugin Settings Change vulnerability
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.1.4.
CVSS v3.1: 6.5
GHSA-qqp5-v5ph-5jqv: makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.
CVSS v3.1: 8.8
CVE-2025-59964: Junos OS: SRX4700: When forwarding-options sampling is enabled any traffic destined to the RE will cause the forwarding line card to crash and restart
A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When forwarding-options sampling is enabled, receipt of any traffic destined to the Routing Engine (RE) by the PFE line card leads to an FPC crash and restart, resulting in a Denial of Service (DoS). 

Continued receipt and processing of any traffic leading to the RE by the PFE line card will create a sustained Denial of Service (DoS) condition to the PFE line card.


This issue affects Junos OS on SRX4700: 



  *  from 24.4 before 24.4R1-S3, 24.4R2


This issue affects IPv4 and IPv6.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-6f6v-7779-324h: Check Point VPN-1/FireWall-1 4.1 and earlier improperly retransmits encapsulated FWS packets, even if they do not come from a valid FWZ client, aka "Retransmission of Encapsulated Packets."
CVE-2025-57578: An issue in H3C Magic M Device M2V100R006 allows a remote attacker to execute arbitrary code via the default password
CVSS v3.1: 8
GHSA-3qrq-p37g-j4wm: An issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST request, due to lack of size validation. This vulnerability requires the attacker to send a crafted HTTP POST request with a URI longer than 50 bytes. This leads to a heap overflow in wbs_post() via an strcpy() call.
CVE-2025-56432: A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data.
CVSS v3.1: 6.1
GHSA-7qw2-p67q-h5xq: The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain typeset restrictions on the generation of GetElementIC typed array stubs, which has unspecified impact and remote attack vectors.
CVSS v3.1: 9.8
CVE-2024-35302: In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible
CVSS v3.1: 5.4
GHSA-m2jr-p4mq-jg77: TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.
CVSS v3.1: 9.8
CVE-2026-34208: SandboxJS: Sandbox integrity escape
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.constructor.call(target, attackerObject). Because this.constructor resolves to the internal SandboxGlobal function and Function.prototype.call is allowed, attacker code can write arbitrary properties into host global objects and persist those mutations across sandbox instances in the same process. This vulnerability is fixed in 0.8.36.
CVSS v3.1: 10
GHSA-55j4-w9wc-h4fx: In the Linux kernel before 3.1, an off by one in the drivers/target/loopback/tcm_loop.c tcm_loop_make_naa_tpg() function could result in at least memory corruption.
CVSS v3.1: 9.8
GHSA-f4v7-w5wp-p585: The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS 12.2, 15.0, 15.1, 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.2SE, 3.3SE, 3.3XO, 3.4SG, 3.5E, and 3.6E before 3.6.3E; 3.7E before 3.7.2E; 3.9S and 3.10S before 3.10.6S; 3.11S before 3.11.4S; 3.12S and 3.13S before 3.13.3S; and 3.14S before 3.14.2S allows remote attackers to cause a denial of service (device reload) via a malformed ND packet with the Cryptographically Generated Address (CGA) option, aka Bug ID CSCuo04400.
CVE-2018-11346: An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "download_sys_settings" action and then specify files arbitrarily throughout the system via the act parameter.
CVSS v3.0: 4.3
CVSS v2.0: 4
CVE-2025-59780: General Industrial Controls Lynx+ Gateway Missing Authentication for Critical Function
General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which 
could allow an attacker to send GET requests to obtain sensitive device 
information.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-vp7c-hm6v-v22g: Untrusted search path vulnerability in BlackBerry Desktop Software before 6.0.0.47 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as a file that is processed by Blackberry.
CVE-2007-1891: Stack-based buffer overflow in the GetPrivateProfileSectionW function in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) after 2.0.4.4 but before 2.2.1.0 allows remote attackers to execute arbitrary code, related to misinterpretation of the nSize parameter as a byte count instead of a wide character count.
CVSS v2.0: 9.3
CVE-2025-24833: Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
CVSS v4.0: 4.8
CVSS v3.0: 5.4
GHSA-5mr4-h7fw-j3h9: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB ver.1.1.5 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker.
CVSS v3.0: 9.8
GHSA-gp6x-x64p-2cpc: Improper input validation in firmware for some Intel(R) FPGA products before version 2.9.1 may allow denial of service.
CVSS v3.1: 4.4
CVE-2025-5462: A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service.
CVSS v3.1: 7.5
CVE-2023-5459: Delta Electronics DVP32ES2 PLC Password Transmission denial of service
A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. VDB-241582 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 6.5
CVSS v3.0: 6.5
CVSS v2.0: 6.1
CVE-2016-1471: Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz76232.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2021-29109: A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9.
A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
CVSS v3.0: 6.1