ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2019-5608: In FreeBSD 12.0-STABLE before r350648, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350650, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE before 11.2-RELEASE-p13, the ICMPv6 input path incorrectly handles cases where an MLDv2 listener query packet is internally fragmented across multiple mbufs. A remote attacker may be able to cause an out-of-bounds read or write that may cause the kernel to attempt to access an unmapped page and subsequently panic.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-4xgg-rw35-7mv5: Magento Improper Authorization leads to Security feature bypass
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
CVSS v3.1: 4.3
CVE-2007-5585: xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras (GL extras) installed, crashes when /usr/bin/xscreensaver-gl-helper does not exist and a user attempts to unlock the screen, which allows attackers with physical access to gain access to the locked session.
CVSS v2.0: 5
GHSA-35hv-q2xv-q24x: Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct request to the file in wp-content/plugins/downloads-manager/upload/.
GHSA-p2fr-mq9m-6w6p: Cross-site Scripting in Jenkins Email Extension Plugin
Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.
CVSS v3.1: 5.4
GHSA-2jgc-rcc5-7q6j: runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1 URI via the rtsp:// protocol to receive the video and audio stream.
CVSS v3.1: 6.5
GHSA-r86c-jfhj-2f8j: The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
GHSA-r454-mqjh-f2pc: A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS v3.0: 8.8
CVE-2017-1000600: WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9
CVSS v3.0: 8.8
CVSS v2.0: 6.5
GHSA-jrv2-7qh6-cgcr: In the Linux kernel, the following vulnerability has been resolved:KVM: x86: Reset IRTE to host control if *new* route isn't postableRestore an IRTE back to host control (remapped or posted MSI mode) if the
*new* GSI route prevents posting the IRQ directly to a vCPU, regardless of
the GSI routing type.  Updating the IRTE if and only if the new GSI is an
MSI results in KVM leaving an IRTE posting to a vCPU.The dangling IRTE can result in interrupts being incorrectly delivered to
the guest, and in the worst case scenario can result in use-after-free,
e.g. if the VM is torn down, but the underlying host IRQ isn't freed.
CVSS v3.1: 7.8
GHSA-vh6r-wx95-v75w: A vulnerability, which was classified as critical, has been found in Campcodes Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/transaction.php. The manipulation of the argument cid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-837j-xr3g-c46p: IBM Cognos Controller 11.0.0 and 11.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS v3.1: 5.9
GHSA-xq44-w95m-vr58: Google Chrome before 1.0.154.53 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
GHSA-vq9q-6qq7-3jfp: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via DCTStream::getChar() at /xpdf/Stream.cc.
CVSS v3.1: 5.5
CVE-2022-24544: Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-7v33-w57q-9g8p: Honor 5A,Honor 8 Lite,Mate9,Mate9 Pro,P10,P10 Plus Huawei smartphones with software the versions before CAM-L03C605B143CUSTC605D003,the versions before Prague-L03C605B161,the versions before Prague-L23C605B160,the versions before MHA-AL00C00B225,the versions before LON-AL00C00B225,the versions before VTR-AL00C00B167,the versions before VTR-TL00C01B167,the versions before VKY-AL00C00B167,the versions before VKY-TL00C01B167 have a resource exhaustion vulnerability due to configure setting. An attacker tricks a user into installing a malicious application, the application may turn on the device flash-light and rapidly drain the device battery.
CVSS v3.0: 5.5
GHSA-5f6m-6vj6-cf3c: GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.
CVSS v3.0: 4.8
GHSA-94g7-q96f-v54w: TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.
CVSS v3.1: 9.1
CVE-2008-4521: SQL injection vulnerability in thisraidprogress.php in the World of Warcraft tracker infusion (raidtracker_panel) module 2.0 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the INFO_RAID_ID parameter.
CVSS v2.0: 7.5
GHSA-vvhw-v3wp-4m8r: A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to read and modify configuration data in the context of the application process.
CVSS v3.1: 6.6
CVE-2019-5371: A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVSS v3.0: 8.8
CVSS v2.0: 9
GHSA-6w5r-99x5-qx74: Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the receive method.
CVE-2026-27814: EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase ↔ 3-phase switch request (`ac_switch_three_phases_while_charging`) during charging/waiting executes concurrently with the state machine loop. Version 2026.02.0 contains a patch.
CVSS v3.1: 4.2
GHSA-fm7q-5fr8-q7xq: SQL injection vulnerability in content.php in Scripts For Sites (SFS) EZ Career allows remote attackers to execute arbitrary SQL commands via the topic parameter.
GHSA-4mh7-v2h4-6vf9: An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component.
CVSS v3.1: 7.8
GHSA-444q-7pcf-frfw: The awhost32 service in Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), and Altiris Deployment Solution Remote pcAnywhere Solution 7.1 (aka 12.5.x and 12.6.x) allows remote attackers to cause a denial of service (daemon crash) via a crafted TCP session on port 5631.
CVE-2005-1685: episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp.
CVSS v2.0: 7.5
RHSA-2017:1759: Red Hat Security Advisory: freeradius security update
freeradius: Out-of-bounds read/write due to improper output buffer size check in make_secret() freeradius: Out-of-bounds write in rad_coalesce() freeradius: Memory leak in decode_tlv() freeradius: Memory leak in fr_dhcp_decode() freeradius: Out-of-bounds read in fr_dhcp_decode_options() freeradius: Out-of-bounds read in fr_dhcp_decode() when decoding option 63
CVSS v3.0: 5.9
CVE-2020-15829: In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2008-0808: Cross-site scripting (XSS) vulnerability in the meta plugin in Ikiwiki before 1.1.47 allows remote attackers to inject arbitrary web script or HTML via meta tags.
CVSS v2.0: 4.3
GHSA-fx2m-qwmj-5p23: A vulnerability, which was classified as problematic, has been found in boyiddha Automated-Mess-Management-System 1.0. Affected by this issue is some unknown functionality of the file /member/member_edit.php. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-256052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 3.5
GHSA-hq4f-5qjv-fwrg: The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location
The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. This allows an unauthenticated remote user to download created backups and configuration files.
CVSS v3.1: 8.6
RHSA-2020:0295: Red Hat Security Advisory: firefox security update
Mozilla: Buffer overflow in plain text serializer Mozilla: Use-after-free in worker destruction Mozilla: Use-after-free when performing device orientation checks Mozilla: Use-after-free when retrieving a document in antitracking Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 Mozilla: Bypass of @namespace CSS sanitization during pasting Mozilla: Type Confusion in XPCVariant.cpp Mozilla: CSS sanitization does not escape HTML tags Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVE-2025-2950: IBM i improper HTTP header neutralization
IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior.
CVSS v3.1: 5.4
CVE-2021-39981: Chang Lian application has a vulnerability which can be maliciously exploited to hide the calling number.Successful exploitation of this vulnerability allows you to make an anonymous call.
CVSS v3.1: 5.3
CVSS v2.0: 4.3
GHSA-x37p-34pw-gv66: Integer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a TIFF image file with modified (1) "strips" (StripByteCounts) or (2) "bands" (StripOffsets) values.
GHSA-c4vv-jj8j-5j6c: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6, macOS Monterey 12.7.6, macOS Ventura 13.6.8. An app may be able to access user-sensitive data.
CVSS v3.1: 5.5
cisco-sa-20180418-MATE1: Cisco MATE Live Directory Information Disclosure Vulnerability
A vulnerability in the web interface of Cisco MATE Live could allow an unauthenticated, remote attacker to view and download the contents of certain web application virtual directories.

The vulnerability is due to lack of proper input validation and authorization of HTTP requests. An attacker could exploit this vulnerability by sending a malicious HTTP request to the targeted application. An exploit could allow the attacker to view sensitive information that should require authentication.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-MATE1 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-MATE1"]
CVSS v3.0: 5.3
GHSA-3vvp-9ghf-fqvw: praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write.
CVSS v3.1: 6.4
CVE-2020-29656: An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. A direct access to /downloadmaster/dm_apply.cgi?action_mode=initial&download_type=General&special_cgi=get_language makes it possible to reach "unknown functionality" in a "known to be easy" manner via an unspecified "public exploit."
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2004-2449: Roger Wilco 1.4.1.6 and earlier or Roger Wilco Base Station 0.30a and earlier allows remote attackers to cause a denial of service (application crash) via a long, malformed UDP datagram.
CVSS v2.0: 5
CVE-2026-46908: Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts Payable).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Accounts Payable.  While the vulnerability is in JD Edwards EnterpriseOne Accounts Payable, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Accounts Payable. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.1: 9.9
GHSA-q64r-wvx9-6g34: Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the view parameter.  NOTE: some of these details are obtained from third party information.
CVE-2001-0477: Vulnerability in WebCalendar 0.9.26 allows remote command execution.
CVSS v2.0: 7.5
CVE-2026-34227: Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data (e.g. SSH keys, ntds.dit) or destroying the entire compromised infrastructure, entirely through the operator's own browser. This issue has been patched in version 1.7.4.
CVSS v4.0: 5.9
CVE-2007-4944: The canvas.createPattern function in Opera 9.x before 9.22 for Linux, FreeBSD, and Solaris does not clear memory before using it to process a new pattern, which allows remote attackers to obtain sensitive information (memory contents) via JavaScript.
CVSS v2.0: 5
GHSA-23m3-jp2w-3vpp: The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.
CVSS v3.0: 7.3
GHSA-xhfc-5f5p-c55v: Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
CVSS v3.1: 8.8
GHSA-8c7h-fr9h-c84m: Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  While the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as  unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
CVSS v3.1: 6.4
GHSA-8c66-9w2h-5cm9: SQL injection vulnerability in the EXP Shop (com_expshop) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a show_payment action to index.php.
GHSA-w5mc-rjm5-5w3q: Buffer overflow in the web-based management interface on the Cisco Linksys WRT54GC router with firmware before 1.06.1 allows remote attackers to cause a denial of service (device crash) via a long string in a POST request.
GHSA-2pjf-gmmm-fv82: FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.
CVSS v3.1: 9.8
CVE-2021-1137: Cisco SD-WAN vManage Software Vulnerabilities
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 7.8
CVE-2006-2987: Multiple SQL injection vulnerabilities in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) voteid, and (3) vfiel parameters to (a) index.php, and via the (4) nick, (5) email, (6) city, (7) messen, and (8) message form field parameters to (b) add.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0: 7.5
GHSA-638v-9w3r-gh6q: xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVSS v3.1: 6.9
GHSA-6fjc-q4q2-mv97: A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
CVE-2025-60798: phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.
CVSS v3.1: 6.5
CVE-2026-14154: Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
GHSA-qchv-qqp6-v795: IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions.
CVSS v3.1: 6.3
CVE-2019-16775: Unauthorized File Access in npm CLI before before version 6.13.3
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
CVSS v3.1: 7.7
GHSA-5342-24w2-77w3: PHP remote file inclusion vulnerability in admin/auth.php in EternalMart Guestbook (EMGB) 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the emgb_admin_path parameter.
GHSA-9rgw-wj76-5w5x: deepin-clone before 1.1.3 uses a fixed path /tmp/partclone.log in the Helper::getPartitionSizeInfo() function to write a log file as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled.
CVSS v3.0: 5.5
GHSA-j372-v4w2-c5fm: The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation.
CVSS v3.1: 9.8
CVE-2024-37333: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2025-42999: Insecure Deserialization in SAP NetWeaver (Visual Composer development server)
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
CVSS v3.1: 9.1
GHSA-pg4x-mm39-59q8: Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
CVE-2015-7272: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long SSH username or input.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-gj5v-2g4g-3xxm: Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer, cfg[BgcolorOne], or strServerChoice parameters in select_server.lib.php, (2) the bg_color or row_no parameters in display_tbl_links.lib.php, the left_font_family parameter in theme_left.css.php, or the right_font_family parameter in theme_right.css.php.
GHSA-2wwh-qgh8-w9xw: Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability
Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not require POST requests for an HTTP endpoint, resulting in cross-site request forgery (CSRF) vulnerabilities.This vulnerability allows attackers to delete Failure Causes.Build Failure Analyzer Plugin 2.4.2 requires POST requests for the affected HTTP endpoint.
CVSS v3.1: 4.3
CVE-2022-27505: Reflected cross site scripting (XSS)
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-jhwv-h83w-79m9: The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.
CVSS v3.1: 8.8
CVE-2005-3969: SQL injection vulnerability in MXChange before 0.2.0-pre10 PL492 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS v2.0: 7.5
GHSA-8mpx-pv9q-6xpj: An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the uploadfiles.php component.
CVSS v3.1: 7.5
GHSA-p28f-wv4w-g7vp: A vulnerability in the file download functions for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to download system files that should be restricted. More Information: CSCvc99446. Known Affected Releases: 11.5(0).
CVSS v3.0: 4.3
GHSA-hqm7-387p-82rc: SQL injection vulnerability in browsecats.php in E-Php CMS allows remote attackers to execute arbitrary SQL commands via the cid parameter.