ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-v23r-23h4-h97g: Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
RHSA-2021:2405: Red Hat Security Advisory: dhcp security update
dhcp: stack-based buffer overflow when parsing statements with colon-separated hex digits in config or lease files in dhcpd and dhclient
CVSS v3.1: 8.8
GHSA-hxf8-xcpr-jpxf: A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /system/system/admins/assessments/pretest/loaddata.php. Such manipulation of the argument difficulty_id leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-c8r9-3pm5-m364: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.
CVSS v3.1: 4.4
CVE-2009-4415: Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to (1) read arbitrary files via the csvfile parameter to addressbook/csv_import.php, or (2) include and execute arbitrary local files via the conv_type parameter in addressbook/inc/class.uiXport.inc.php.
CVSS v2.0: 7.5
CVE-2014-10031: Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary code via a long string in a UID command.
CVSS v2.0: 7.5
GHSA-2q68-vqm6-gwxg: Cross-site scripting (XSS) vulnerability in index.php in ClonusWiki .5 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
GHSA-3w26-vfvh-2v33: A potential memory leakage vulnerability was reported in some Lenovo Notebook products that may allow a local attacker with elevated privileges to write to NVRAM variables.
CVSS v3.1: 6.7
CVE-2020-28425: Command Injection
This affects all versions of package curljs.
CVSS v3.1: 7.3
GHSA-9vh8-8gpj-8c68: Insufficient control flow management in BIOS firmware 8th, 9th Generation Intel(R) Core(TM) Processors and Intel(R) Celeron(R) Processor 4000 Series may allow an authenticated user to potentially enable information disclosure via local access.
GHSA-8jfh-2hq3-wq5v: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodegearThemes Designer allows PHP Local File Inclusion.This issue affects Designer: from n/a through 1.3.3.
CVSS v3.1: 7.5
VA-25-021-01: Fedora Repository fedoraIntCallUser default credentials and insecure archive extraction
Fedora Repository 3.8.x allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23). Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).
CVSS v3.1: 7.5
CVE-2024-3204: c-blosc2 ndlz4x4.c ndlz4_decompress heap-based overflow
A vulnerability has been found in c-blosc2 up to 2.13.2 and classified as critical. Affected by this vulnerability is the function ndlz4_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.14.3 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-259051.
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2025-27428: Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)
Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled function module. Upon successful exploitation, they could read files from any managed system connected to SAP Solution Manager, leading to high impact on confidentiality. There is no impact on integrity or availability.
CVSS v3.1: 7.7
CVE-2005-1296: include.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
CVSS v2.0: 7.5
CVE-2019-1486: A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host, aka 'Visual Studio Live Share Spoofing Vulnerability'.
CVSS v3.1: 6.1
CVSS v2.0: 5.8
GHSA-33qp-rrww-3f5q: Elgg through 1.7.10 has a SQL injection vulnerability
GHSA-v775-c4m3-q2r5: The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
CVSS v3.1: 6.1
GHSA-978w-jwq5-2hmx: An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There is pervasive CSRF.
CVE-2015-5287: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
CVSS v2.0: 6.9
CVE-2024-57493: An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the setsockopt function.
CVSS v3.1: 5.5
GHSA-5r4w-j78w-5frr: Directory traversal vulnerability in popup.php in RadScripts RadLance Gold 7.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the read parameter.
GHSA-32r2-xfqh-9qx6: An issue was discovered on certain Nuki Home Solutions devices. By sending a malformed HTTP verb, it is possible to force a reboot of the device. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
CVSS v3.1: 7.5
RHSA-2015:0998: Red Hat Security Advisory: qemu-kvm security update
qemu: fdc: out-of-bounds fifo buffer memory access
GHSA-j9xj-cjf3-9jxj: IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arbitrary organization.
CVSS v3.1: 4.3
CVE-2014-5847: The Big Win Slots - Slot Machines (aka com.gosub60.BigWinSlots) application 1.11.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
GHSA-8frh-qm3q-94gh: An information disclosure vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64550583.
CVSS v3.0: 9.1
GHSA-h8f7-fm9g-4rmg: Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Verified Boot.
CVE-2018-9009: In libming 0.4.8, there is a use-after-free in the decompileJUMP function of the decompile.c file.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2024-33764: lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.
CVSS v3.1: 5.5
CVE-2023-52285: ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s_score2 parameter.
CVSS v3.1: 7.5
CVE-2019-12999: Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2019-8749: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6, iTunes 12.10.1 for Windows. Multiple issues in libxml2.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-3rgg-96v5-5857: Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter.
CVSS v3.0: 7.5
GHSA-676g-35q7-rhh4: Cisco IOS 12.1, 12.2, 12.3, and 12.4, with IPv4 UDP services and the IPv6 protocol enabled, allows remote attackers to cause a denial of service (device crash and possible blocked interface) via a crafted IPv6 packet to the device.
GHSA-68rm-9q2m-3j7p: Multiple cross-site scripting (XSS) vulnerabilities in SquidClamav 5.x before 5.8 allow remote attackers to inject arbitrary web script or HTML via the (1) url, (2) virus, (3) source, or (4) user parameter to (a) clwarn.cgi, (b) clwarn.cgi.de_DE, (c) clwarn.cgi.en_EN, (d) clwarn.cgi.fr_FR, (e) clwarn.cgi.pt_BR, or (f) clwarn.cgi.ru_RU in cgi-bin/.
CVE-2019-10721: BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx.
CVSS v3.0: 6.1
CVSS v2.0: 5.8
GHSA-99j3-qj37-v8c5: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
GHSA-f63f-3434-4v3m: A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323, CVE-2019-18324, CVE-2019-18325, CVE-2019-18326, CVE-2019-18327, CVE-2019-18328, and CVE-2019-18329. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
GHSA-j9hf-r5pg-vwfx: Unspecified vulnerability in My Photo Gallery 3.5, and possibly earlier versions, has unknown impact and attack vectors.
GHSA-5jpg-pvqp-h5cm: A stack-based buffer overflow vulnerability in the P2P API service in BS Producten Petcam with firmware 33.1.0.0818 allows unauthenticated attackers within network range to overwrite the instruction pointer and achieve Remote Code Execution (RCE) by sending a specially crafted HTTP request.
CVSS v3.1: 8.8
GHSA-77qw-jxwx-7hx3: The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.
GHSA-v4j5-wj6h-f47p: Windows Hyper-V Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
CVE-2025-30615: WordPress WP e-Commerce Style Email plugin <= 0.6.2 - CSRF to Remote Code Execution vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Code Injection.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.
CVSS v3.1: 9.6
CVE-2023-31273: Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS v3.1: 10
CVE-2024-51981: Unauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, and Konica Minolta, Inc.
An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control all the HTTP data sent in the SSRF connection, but the attacker can not receive any data back from this connection.
CVSS v3.1: 5.3
CVE-2017-16170: liuyaserver is a static file server. liuyaserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2015-7928: eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVSS v3.0: 8.5
CVSS v2.0: 5
CVE-2013-1727: Mozilla Firefox before 24.0 on Android allows attackers to bypass the Same Origin Policy, and consequently conduct cross-site scripting (XSS) attacks or obtain password or cookie information, by using a symlink in conjunction with a file: URL for a local file.
CVSS v2.0: 4
CVE-2024-22547: WayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS).
CVSS v3.1: 4.7
GHSA-243h-4j57-f7gh: Multiple stack-based buffer overflows in in_mp3.dll in Winamp 5.21, 5.5, and 5.51 allow remote attackers to execute arbitrary code via a long (1) artist or (2) name tag in Ultravox streaming metadata, related to construction of stream titles.
GHSA-mqx5-2443-fv43: ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors.
CVSS v3.0: 3.3
GHSA-mj6f-85xq-rjq8: A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated user to escalate its privilege to root using switch commands “supportlink”, “firmwaredownload”, “portcfgupload, license, and “fosexec”.
CVSS v3.1: 7.8
GHSA-rmrx-q22j-r2fx: Verint Workforce Optimization (WFO) 15.2 allows HTML injection via the "send email" feature.
GHSA-qmc2-x7wp-66p7: Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment.  NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries.
GHSA-73w8-4h43-h886: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Data Dictionary). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
GHSA-v5r7-gp5q-w3fh: Multiple unspecified vulnerabilities in Gyach Enhanced (Gyach-E) before 1.0.5 have unknown impact and attack vectors related to "several security flaws," probably related to buffer overflows in HTTP server responses.
GHSA-grj6-95wm-6gmg: An unsafe pointer vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler. An attacker can use this unsafe pointer "current_ptr" to read or write or manipulate data into SMRAM. Exploitation of this vulnerability can lead to escalation of privileges reserved only for SMM using the SwSMI handler.
CVSS v3.1: 8.2
GHSA-7x3j-8xcm-h43m: IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX008, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not properly handle logout actions, which allows remote attackers to bypass intended Cognos BI Direct Integration access restrictions by leveraging an unattended workstation.
GHSA-ch53-6vvw-hvmw: mykdownload.php in MyKtools 2.4 does not require administrative authentication, which allows remote attackers to read a database backup by making a direct request, and then sending an unspecified request to the download page for the backup.
CVE-2021-40025: The eID module has a vulnerability that causes the memory to be used without being initialized,Successful exploitation of this vulnerability may affect data confidentiality.
CVSS v3.1: 7.5
CVSS v2.0: 5
RHSA-2020:2473: Red Hat Security Advisory: pcs security and bug fix update
rubygem-json: Unsafe object creation vulnerability in JSON
CVSS v3.1: 7.3
CVE-2025-25079: WordPress Simple Select All Text Box plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Select All Text Box simple-select-all-text-box allows Stored XSS.This issue affects Simple Select All Text Box: from n/a through <= 3.2.
CVSS v3.1: 6.5
GHSA-rpmg-2c2q-36cp: Win32k Information Disclosure Vulnerability
CVSS v3.1: 5.5
CVE-2023-45688: Information leak via path traversal in Titan MFT and Titan SFTP servers
Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command
CVSS v3.1: 4.3
CVE-2024-48416: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/fromSetLanDhcpsClientbinding.
CVSS v3.1: 8.8
CVE-2018-5473: An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior. The SSH functions of the device are vulnerable to buffer overflow conditions that may allow a remote attacker to execute arbitrary code on the device.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2023-51517: WordPress Calculated Fields Form Plugin <= 1.2.28 is vulnerable to Open Redirection
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a through 1.2.28.
CVSS v3.1: 4.1
CVE-2024-1056: Funnel Kit Funnel Builder PRO <= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post
The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_iframe_tag_in_post' function which uses the 'wp_kses_allowed_html' filter to globally allow script and iframe tags in posts in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-j322-mvhj-p6c7: The HTTP server in Cisco IOS on Catalyst switches does not properly handle TCP socket events, which allows remote attackers to cause a denial of service (device crash) via crafted packets on TCP port (1) 80 or (2) 443, aka Bug ID CSCuc53853.
CVE-2026-46479: Flowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluation create and update mass-assignment allows cross-workspace evaluation takeover. This issue has been patched in version 3.1.2.
CVSS v4.0: 7.7
CVE-2018-11781: Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
CVSS v3.0: 7.8
CVSS v2.0: 4.6
GHSA-785w-f5m3-3g56: The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.
RHSA-2014:0889: Red Hat Security Advisory: java-1.7.0-openjdk security update
OpenJDK: Restrict use of privileged annotations (Libraries, 8034985) OpenJDK: Event logger format string vulnerability (Hotspot, 8037076) OpenJDK: SubjectDelegator protection insufficient (JMX, 8029755) OpenJDK: Incorrect generic signature attribute parsing (Hotspot, 8037076) OpenJDK: Clone interfaces passed to proxy methods (Libraries, 8035009) OpenJDK: Bytecode verification does not prevent ctor calls to this() and super() (Hotspot, 8035119) OpenJDK: MethodHandles.Lookup insufficient modifiers checks (Libraries, 8035788) OpenJDK: Incorrect handling of invocations with exhausted ranks (Libraries, 8035793) OpenJDK: RSA blinding issues (Security, 8031346) OpenJDK: Prevent instantiation of service with non-public constructor (Security, 8035004) OpenJDK: AtomicReferenceFieldUpdater missing primitive type check (Libraries, 8039520) OpenJDK: insufficient Diffie-Hellman public key validation (Security, 8037162) OpenJDK: InfoBuilder incorrect return values (Serviceability, 8033301)
GHSA-f2x4-547g-rp95: OpenFlow plugin for OpenDaylight LLDP Relay
OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP packets, aka "LLDP Relay."
CVSS v3.0: 7.5
CVE-2007-0760: EQdkp 1.3.1 and earlier authenticates administrative requests by verifying that the HTTP Referer header specifies an admin/ URL, which allows remote attackers to read or modify account names and passwords via a spoofed Referer.
CVSS v2.0: 7.5
CVE-2015-10126: Easy2Map Photos Plugin sql injection
A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The patch is identified as 503d9ee2482d27c065f78d9546f076a406189908. It is recommended to upgrade the affected component. VDB-241318 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-r4vq-r3rv-8p3p: aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome).
CVE-2006-0987: The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.
CVSS v2.0: 5
GHSA-cv3r-f243-cvhc: Format string vulnerability in Songbird Media Player 0.2 and earlier allows remote attackers to cause a denial of service (crash) via an M3U Playlist file containing extended ASCII, which causes the Unicode converter to be invoked.
GHSA-qj2q-q979-fccj: The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.3, due to insufficient escaping on the user supplied 'objects' and 'tags' parameters and lack of sufficient preparation in the 'update_options' function as well as the 'refresh' function which runs queries on the same values. This allows authenticated attackers, with administrator permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note that this attack may only be practical on configurations where it is possible to bypass addslashes due to the database using a nonstandard character set such as GBK.
CVSS v3.1: 6.6