ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-7xhv-hcmf-4rfv: A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.The issue affects users of the Node.js permission model on version v25.In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
CVSS v3.0: 5.8
CVE-2023-53735: WEBIGniter 28.7.23 Cross-Site Scripting (XSS) in User Creation Process
WEBIGniter 28.7.23 contains a cross-site scripting vulnerability in the user creation process that allows unauthenticated attackers to execute malicious JavaScript code, enabling potential XSS attacks.
CVSS v4.0: 5.3
GHSA-h4h6-vccr-44h2: uptrace pgdriver SQL injection vulnerability
uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in `/pgdriver/format.go`. The maintainer has stated that the issue is fixed in v1.2.15.
CVSS v3.1: 6.5
CVE-2017-9831: An integer overflow vulnerability in the ptp_unpack_EOS_CustomFuncEx function of the ptp-pack.c file of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable.
CVSS v3.0: 6.8
CVSS v2.0: 4.6
GHSA-3794-vfg4-p57g: A remote vulnerability was discovered in Aruba Instant On 1930 Switch Series version(s): Firmware below v1.0.7.0.
CVSS v3.1: 6.5
GHSA-h77x-2hj5-ggjw: The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.
CVE-2019-20842: An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There is SQL injection by admins via SearchAllChannels.
CVSS v3.1: 7.2
CVSS v2.0: 6.5
CVE-2024-0945: 60IndexPage Parameter file.php server-side request forgery
A vulnerability classified as critical has been found in 60IndexPage up to 1.8.5. This affects an unknown part of the file /include/file.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252189 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2020-36791: net_sched: keep alloc_hash updated after hash allocation
In the Linux kernel, the following vulnerability has been resolved:

net_sched: keep alloc_hash updated after hash allocation

In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex")
I moved cp->hash calculation before the first
tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched.
This difference could lead to another out of bound access.

cp->alloc_hash should always be the size allocated, we should
update it after this tcindex_alloc_perfect_hash().
CVSS v3.1: 7.1
GHSA-8698-v858-43rf: The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing authorization checks on the SubmitCatProductRequest AJAX action. This makes it possible for unauthenticated attackers to create arbitrary WooCommerce products with custom names, prices, and category assignments via the 'Name', 'Price', and 'Parent' parameters.
CVSS v3.1: 5.3
GHSA-96v6-6549-c5x9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice &amp; Consent Banner for GDPR &amp; CCPA Compliance allows Stored XSS. This issue affects Cookie Notice &amp; Consent Banner for GDPR &amp; CCPA Compliance: from n/a through 1.7.11.
CVSS v3.1: 6.5
CVE-2025-49980: WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability
Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through <= 1.0.6.
CVSS v3.1: 4.3
GHSA-8h2r-r59q-86xf: Unspecified vulnerability in WebUI in ADempiere Bazaar before 3.3 beta Victoria edition allows remote attackers to access system-level windows via unspecified vectors.
GHSA-rg35-3gfr-j5rq: goform/WClientMACList on Cisco EPC3928 devices allows remote attackers to cause a denial of service (device crash) via a long h_sortWireless parameter, related to a "Gateway Client List Denial of Service" issue, aka Bug ID CSCux24948.
CVSS v3.0: 7.5
GHSA-5h8r-vjr2-25c6: Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.
CVSS v3.1: 8.1
CVE-2025-1533: A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (BSOD) or other potentially undefined execution.
Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
CVSS v4.0: 8.2
GHSA-j5q7-fp4m-m2wp: A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
CVSS v3.0: 8.8
CVE-2018-12674: The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) stores the username and password within the cookies of a session. If an attacker gained access to these session cookies, it would be possible to gain access to the username and password of the logged-in account.
CVSS v3.0: 5.7
CVSS v2.0: 2.9
CVE-2013-0783: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS v2.0: 9.3
CVE-2023-32230: An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation.
CVSS v3.1: 7.5
GHSA-chj4-5w8w-6gg4: Missing Authorization vulnerability in PriceListo Best Restaurant Menu by PriceListo.This issue affects Best Restaurant Menu by PriceListo: from n/a through 1.4.2.
CVSS v3.1: 4.3
GHSA-vxvr-qr96-crx5: Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id_forum, (2) id_article, or (3) id_breve parameters to forum.php3; (4) unspecified vectors related to "session handling"; and (5) when posting "petitions".
GHSA-79hx-qq8c-36qm: Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
CVSS v3.1: 5.3
GHSA-48xc-cq48-4xjv: Unspecified vulnerability in the Sun ZFS Storage Appliance Kit (AK) component in Oracle Sun Systems Products Suite AK 2013 allows local users to affect confidentiality via vectors related to Core Services.
CVSS v3.0: 5.5
CVE-2020-36320: Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7
Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
CVSS v3.1: 7.5
GHSA-gcqv-f29m-67gr: October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip `on*` event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.ImpactStored XSS via malicious SVG files uploaded through the Media ManagerCould allow privilege escalation if a superuser views or embeds the malicious SVGRequires authenticated backend access with media upload permissions (`media.library.create`)SVG must be viewed or embedded in a page to triggerPatchesThe vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.WorkaroundsIf upgrading immediately is not possible:Disable SVG uploads by adding `svg` to the blocked extensions in media configurationSet `media.clean_vectors` to `true` in configuration (enabled by default)ReferencesReported by Pentest-Tools.com
CVSS v4.0: 4.8
CVSS v3.1: 4.8
CVE-2017-8738: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
CVSS v3.0: 7.5
CVSS v2.0: 7.6
GHSA-33x3-2r59-2wch: Visual truncation vulnerability in the MakeScriptDialogTitle function in nsGlobalWindow.cpp in Mozilla Firefox allows remote attackers to spoof the origin domain name of a script via a long name.
GHSA-g676-p673-23rg: Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue.
GHSA-xrvp-gx9p-8ch2: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera extension may be able to access the internet.
CVSS v3.1: 7.5
CVE-2026-45966: apparmor: fix NULL pointer dereference in __unix_needs_revalidation
In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix NULL pointer dereference in __unix_needs_revalidation

When receiving file descriptors via SCM_RIGHTS, both the socket pointer
and the socket's sk pointer can be NULL during socket setup or teardown,
causing NULL pointer dereferences in __unix_needs_revalidation().

This is a regression in AppArmor 5.0.0 (kernel 6.17+) where the new
__unix_needs_revalidation() function was added without proper NULL checks.

The crash manifests as:
  BUG: kernel NULL pointer dereference, address: 0x0000000000000018
  RIP: aa_file_perm+0xb7/0x3b0 (or +0xbe/0x3b0, +0xc0/0x3e0)
  Call Trace:
   apparmor_file_receive+0x42/0x80
   security_file_receive+0x2e/0x50
   receive_fd+0x1d/0xf0
   scm_detach_fds+0xad/0x1c0

The function dereferences sock->sk->sk_family without checking if either
sock or sock->sk is NULL first.

Add NULL checks for both sock and sock->sk before accessing sk_family.
CVSS v3.1: 5.5
GHSA-4wcm-fjh2-x4hg: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
RHSA-2022:5909: Red Hat Security Advisory: Openshift Logging Bug Fix and security update Release (5.2.13)
golang: out-of-bounds read in golang.org/x/text/language leads to DoS
CVSS v3.1: 7.5
GHSA-fmqc-2w48-qp8r: Tyler Identity Local (TID-L) uses documented, default administrative credentials. Users are not required to change the credentials before deployment. TID-L has not been distributed since December 2020, and has not been supported since 2021.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2017-3323: Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: General). Supported versions that are affected are 7.2.25 and earlier, 7.3.14 and earlier and 7.4.12 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS v3.0 Base Score 3.7 (Availability impacts).
CVSS v3.0: 3.7
CVSS v2.0: 4.3
CVE-2020-25123: The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
GHSA-prgq-9r2v-w93p: Open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote information disclosure and arbitrary code execution.
GHSA-4mj3-26h4-xjcm: The Institute Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Enquiry Form Title' setting in all versions up to, and including, 5.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS v3.1: 4.4
PYSEC-2019-229: Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.
RHSA-2017:0484: Red Hat Security Advisory: Red Hat Gluster Storage 3.2.0 security, bug fix, and enhancement update
glusterfs: glusterfs-server %pretrans rpm script temporary file issue
CVSS v3.0: 4.8
GHSA-3pv5-2f7m-jxm4: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.32.7212 versions.
CVSS v3.1: 7.1
GHSA-92rm-hwvx-9vh7: The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview parameter).
CVSS v3.0: 6.1
GHSA-5hj8-2w5c-mmpr: OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata to forward action payloads with Gateway credentials to attacker-supplied loopback URLs. Remote attackers can intercept Gateway tokens and action payloads by providing malicious loopback targets through model-controlled action metadata.
CVSS v4.0: 6
CVSS v3.1: 6.5
GHSA-mfw7-9qmq-xp44: The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.
CVSS v3.1: 7.8
GHSA-v9vh-vj86-fh3j: A NULL Pointer Dereference vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 devices allows an unauthenticated, adjacent attacker to cause aDenial-of-Service (DoS).Whenever specific valid multicast traffic is received on any layer 3 interface the evo-pfemand process crashes and restarts.Continued receipt of specific valid multicast traffic results in a sustained Denial of Service (DoS) attack. 
This issue affects Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509:from 23.2R2-EVO before 23.2R2-S4-EVO,from 23.4R1-EVO before 23.4R2-EVO.This issue affects IPv4 and IPv6.This issue does not affect  Junos OS Evolved ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 versions before 23.2R2-EVO.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
CVE-2019-19587: In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console.
CVSS v3.0: 6.1
RHSA-2023:6112: Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.4 security one-off update
quarkus: HTTP security policy bypass
CVSS v3.1: 8.1
CVE-2025-40087: NFSD: Define a proc_layoutcommit for the FlexFiles layout type
In the Linux kernel, the following vulnerability has been resolved:

NFSD: Define a proc_layoutcommit for the FlexFiles layout type

Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT
operation on a FlexFiles layout.
GHSA-6p8q-f9vc-4mp9: Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.3
CVE-2023-36843: Junos OS: SRX Series: The PFE will crash on receiving malformed SSL traffic when Sky ATP is enabled

An Improper Handling of Inconsistent Special Elements vulnerability in the Junos Services Framework (jsf) module of Juniper Networks Junos OS allows an unauthenticated network based attacker to cause a crash in the Packet Forwarding Engine (pfe) and thereby resulting in a Denial of Service (DoS).

Upon receiving malformed SSL traffic, the PFE crashes. A manual restart will be needed to recover the device.

This issue only affects devices with Juniper Networks Advanced Threat Prevention (ATP) Cloud enabled with Encrypted Traffic Insights (configured via ‘security-metadata-streaming policy’).

This issue affects Juniper Networks Junos OS:



  *  All versions prior to 20.4R3-S8, 20.4R3-S9;
  *  21.1 version 21.1R1 and later versions;
  *  21.2 versions prior to 21.2R3-S6;
  *  21.3 versions prior to 21.3R3-S5;
  *  21.4 versions prior to 21.4R3-S5;
  *  22.1 versions prior to 22.1R3-S4;
  *  22.2 versions prior to 22.2R3-S2;
  *  22.3 versions prior to 22.3R2-S2, 22.3R3;
  *  22.4 versions prior to 22.4R2-S1, 22.4R3;







CVSS v3.1: 7.5
GHSA-f8pr-3cr6-jp4c: WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameters: remoteManagementEnabled, blockPortScanEnabled, pingFrmWANFilterEnabled and blockSynFloodEnabled, which leads to command injection in page /man_security.shtml.
CVSS v3.1: 9.8
RHSA-2025:12450: Red Hat Security Advisory: libxml2 security update
libxslt: libxml2: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr
CVSS v3.1: 7.8
GHSA-v8h9-9g8j-w7h4: An improper validation of user-supplied input leads to a local file inclusion vulnerability.
CVSS v4.0: 7.5
CVSS v3.1: 9.8
CVE-2004-1406: SQL injection vulnerability in ikonboard.cgi in Ikonboard 3.1.0 through 3.1.3 allows remote attackers to inject arbitrary SQL commands via the (1) st or (2) keywords parameter.
CVSS v2.0: 7.5
CVE-2022-4764: Simple File Downloader <= 1.0.4 - Contributor+ Stored XSS via Shortcode
The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS v3.1: 6.8
CVE-2016-2940: Multiple unspecified vulnerabilities in IBM BigFix Remote Control before 9.1.3 allow remote attackers to obtain sensitive information via unknown vectors.
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2013-0974: StoreKit in Apple iOS before 6.1 does not properly handle the disabling of JavaScript within the preferences configuration of Mobile Safari, which allows remote attackers to bypass intended access restrictions and execute JavaScript code via a web site with a Smart App Banner.
CVSS v2.0: 5.1
CVE-2013-2507: Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware G (1.03) allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/log_to_net.html or (2) kind parameter to fax/copy_settings.html, a different vulnerability than CVE-2013-2670 and CVE-2013-2671.
CVSS v2.0: 4.3
GHSA-5c9c-9732-p6mg: The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVSS v3.0: 8.8
CVE-2023-46376: Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.
CVSS v3.1: 7.5
GHSA-f3c2-5v72-7m7f: gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.
CVSS v3.0: 7.6
CVE-2019-9475: In /proc/net of the kernel filesystem, there is a possible information leak due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-9496886
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2020-13514: A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privileges. Using the IRP 0x9c40a0e0 gives a low privilege user direct access to the OUT instruction that is completely unrestrained at an elevated privilege level. An attacker can send a malicious IRP to trigger this vulnerability.
CVSS v3.0: 8.8
GHSA-3hxh-7jxm-59x4: AtomicBucket<T> unconditionally implements Send/Sync
In the affected versions of the crate, `AtomicBucket<T>` unconditionally implements `Send`/`Sync` traits. Therefore, users can create a data race to the inner
`T: !Sync` by using the `AtomicBucket::data_with()` API.
Such data races can potentially cause memory corruption or other undefined behavior.The flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct `Block<T>` (which is a data type contained inside `AtomicBucket<T>`).
GHSA-p549-v45c-9xxx: MagicProject AI version 9.1 is affected by a Cross-Site Scripting (XSS) vulnerability within the chatbot generation feature available to authenticated admin users. The vulnerability resides in the prompt parameter submitted to the /dashboard/user/generator/generate-stream endpoint via a multipart/form-data POST request. Due to insufficient input sanitization, attackers can inject HTML-based JavaScript payloads. This payload is stored and rendered unsanitized in subsequent views, leading to execution in other users' browsers when they access affected content. This issue allows an authenticated attacker to execute arbitrary JavaScript in the context of another user, potentially leading to session hijacking, privilege escalation, data exfiltration, or administrative account takeover. The application does not implement a Content Security Policy (CSP) or adequate input filtering to prevent such attacks. A fix should include proper sanitization, output encoding, and strong CSP enforcement to mitigate exploitation.
CVSS v3.1: 4.8
GHSA-ph8v-q2pj-5pg4: Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component.
CVSS v3.1: 7.5