ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-v79c-w8qr-chq9: Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required.
CVSS v3.1: 9.8
CVE-2018-9035: CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form.
CVSS v3.0: 9.6
CVSS v2.0: 6.8
GHSA-vwq3-96qh-c9vf: Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from network in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9207C, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SA415M, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130
CVE-2023-22636: An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker to access confidential configuration files via a crafted http request.
CVSS v3.1: 6.6
RHSA-2023:0819: Red Hat Security Advisory: thunderbird security update
Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP Mozilla: Content security policy leak in violation reports using iframes Mozilla: Extensions could have opened external schemes without user knowledge Mozilla: Screen hijack via browser fullscreen mode Mozilla: Out of bounds memory write from EncodeInputStream Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext Mozilla: Web Crypto ImportKey crashes tab Mozilla: Fullscreen notification not shown in Firefox Focus Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 Mozilla: Memory safety bugs fixed in Firefox ESR 102.8
CVSS v3.1: 8.8
CVE-2021-28377: ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.
CVSS v3.1: 5.3
CVSS v2.0: 5
GHSA-rwrj-4qmw-jc4j: Investintech.com SlimPDF Reader does not properly restrict the arguments to unspecified function calls, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
CVE-2025-30013: Code Injection vulnerability in SAP ERP BW Business Content
SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handle user input, allowing attacker to inject arbitrary OS commands. This vulnerability allows the execution of unintended commands on the underlying system, posing a significant security risk to the confidentiality, integrity and availability of the application.
CVSS v3.1: 6.7
GHSA-5qj3-2mwp-vp67: A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper input validation when parsing HTTP requests. An attacker could exploit this vulnerability by sending a sustained stream of crafted requests to an affected device. A successful exploit could allow the attacker to cause all subsequent requests to be dropped, resulting in a DoS condition.
CVSS v3.1: 8.6
GHSA-6rjj-pr45-qcv8: Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field, Address field, Town field, Phone field, Mobile field, Place of Birth field, Web Site field, VAT Number field, Last Name field, Fax field, Email field, and Skype field.
CVE-2017-9893: XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to a "User Mode Write AV starting at Xfpx!gffGetFormatInfo+0x0000000000012548."
CVSS v3.0: 7.8
CVSS v2.0: 4.6
GHSA-p9cq-5cfg-3972: Adobe Flash Player before 10.3.183.23 and 11.x before 11.4.402.265 on Windows and Mac OS X, before 10.3.183.23 and 11.x before 11.2.202.238 on Linux, before 11.1.111.16 on Android 2.x and 3.x, and before 11.1.115.17 on Android 4.x; Adobe AIR before 3.4.0.2540; and Adobe AIR SDK before 3.4.0.2540 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-4163 and CVE-2012-4164.
CVE-2026-52755: Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import
Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.
CVSS v4.0: 8.4
CVSS v3.1: 7.8
GHSA-xm2x-rx5v-75x7: The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password.
CVSS v3.1: 7.3
CVE-2025-36463: Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability
Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 4 (`WBIO_USH_ADD_RECORD`) and with an invalid   `SendBufferSize`.
CVSS v3.1: 7.3
CVE-2009-1733: Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors.
CVSS v2.0: 6.8
CVE-2019-11064: A vulnerability of remote credential disclosure was discovered in Advan VD-1
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication.
CVSS v3.1: 9.8
CVSS v2.0: 5
GHSA-pw4m-g482-6hfw: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd allows Stored XSS.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through 6.17.4.
CVSS v3.1: 5.9
GHSA-w5rc-cq4p-9j77: An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It mishandles situations in which an array size (derived from a /Size entry) is smaller than the maximum indirect object number, and thus there is an attempted incorrect array access (leading to a NULL pointer dereference, or out-of-bounds read or write).
CVE-2006-1186: Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption.
CVSS v2.0: 10
GHSA-qvxv-pfwq-9h5h: A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests.
CVSS v3.1: 8.3
CVE-2024-53471: Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/meio_pagamento.php of WeGIA v3.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the id or name parameter.
CVSS v3.1: 6.1
CVE-2023-20130: Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 6.5
GHSA-2727-h6mf-8pqp: In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.
CVSS v3.1: 4.6
CVE-2004-2375: Buffer overflow in the POP3 server in 1st Class Mail Server 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an APOP USER command with a long second parameter (digest).
CVSS v2.0: 7.5
CVE-2025-63069: WordPress Ivory Search plugin <= 5.5.12 - Broken Access Control vulnerability
Missing Authorization vulnerability in Vinod Dalvi Ivory Search add-search-to-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ivory Search: from n/a through <= 5.5.12.
CVSS v3.1: 5.3
CVE-2022-35258: An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.
CVSS v3.1: 7.5
CVE-2018-5246: In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-54jf-p4cr-5xj6: A Missing Release of Memory after Effective Lifetime vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause an rpd crash, leading to Denial of Service (DoS).On all Junos OS and Junos OS Evolved platforms, when traffic engineering is enabled for OSPF or ISIS, and a link flaps, a patroot memory leak is observed. This memory leak, over time, will lead to an rpd crash and restart.The memory usage can be monitored using the below command.user@host> show task memory detail | match patroot
This issue affects:Juniper Networks Junos OSAll versions earlier than 21.2R3-S3;21.3 versions earlier than 21.3R3-S5;21.4 versions earlier than 21.4R3-S3;22.1 versions earlier than 22.1R3;22.2 versions earlier than 22.2R3.Juniper Networks Junos OS EvolvedAll versions earlier than 21.3R3-S5-EVO;21.4 versions earlier than 21.4R3-EVO;22.1 versions earlier than 22.1R3-EVO;22.2 versions earlier than 22.2R3-EVO.
CVSS v3.1: 6.5
GHSA-h38m-mxmf-5c2q: SECOM WRTR-304GN-304TW-UPSC V02(unsupported-when-assigned) does not properly filter user input in the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.
CVSS v3.1: 9.8
GHSA-2fmv-49qj-83rm: novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.
CVSS v3.1: 9.8
RHSA-2021:5219: Red Hat Security Advisory: Red Hat Single Sign-On security update on RHEL 8
Keycloak: Incorrect authorization allows unpriviledged users to create other users
CVSS v3.1: 8.3
CVE-2026-22202: wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection.
CVSS v4.0: 6.1
CVSS v3.1: 8.1
GHSA-g8v9-rw5p-59vq: The NVIDIA kernel in Android before 2016-09-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 29518457.
CVSS v3.0: 7.8
GHSA-78fc-cgpq-9vq9: In secmem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09403554; Issue ID: MSV-2431.
CVSS v3.1: 7.8
CVE-2006-3180: Cross-site scripting (XSS) vulnerability in ftp_index.php in Confixx Pro 3.0 allows remote attackers to inject arbitrary web script or HTML via the path parameter.
CVSS v2.0: 6.8
GHSA-hwhj-v6qm-whw2: DreamMaker developed by Interinfo has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2023-24145: TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function.
CVSS v3.1: 9.8
CVE-2008-4822: Adobe Flash Player 9.0.124.0 and earlier does not properly interpret policy files, which allows remote attackers to bypass a non-root domain policy.
CVSS v2.0: 6.8
GHSA-fx6r-gr7m-2fch: An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVSS v3.1: 6.1
CVE-2022-33275: Improper validation of array index in WLAN HAL
Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
CVSS v3.1: 8.4
CVE-2023-21210: In initiateHs20IconQueryInternal of sta_iface.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262236331
CVSS v3.1: 4.4
RHSA-2011:0461: Red Hat Security Advisory: jboss-seam2 security update
JBoss Seam privilege escalation caused by EL interpolation in FacesMessages
GHSA-j5cc-94pp-784r: A vulnerability in the software image verification functionality of Cisco IOS XE Software for the Cisco Catalyst 9000 Family of switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. The vulnerability is due to an improper check in the code function that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by loading unsigned software on an affected device. A successful exploit could allow the attacker to boot a malicious software image or execute unsigned code and bypass the image verification check part of the secure boot process of an affected device. To exploit this vulnerability, the attacker would need to have unauthenticated physical access to the device or obtain privileged access to the root shell on the device.
GHSA-v99j-m2v5-3c7x: A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass.
RHSA-2025:17741: Red Hat Security Advisory: webkit2gtk3 security update
webkitgtk: Processing maliciously crafted web content may lead to memory corruption webkitgtk: Processing maliciously crafted web content may lead to memory corruption webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: A website may be able to access sensor information without user consent webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash webkitgtk: Processing maliciously crafted web content may lead to memory corruption
CVSS v3.1: 8.8
GHSA-j47h-x8qg-vv7c: Reflected XSS in wordpress plugin wpsolr-search-engine v7.6
CVSS v3.0: 6.1
GHSA-jxr7-8pxr-xxf7: The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to create, update, delete, and publish malicious workflows that may automatically delete any post upon publication or update, including posts created by administrators.
CVSS v3.1: 5.4
RHSA-2020:2770: Red Hat Security Advisory: kernel security and bug fix update
kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS
CVSS v3.0: 6.4
CVE-2017-3650: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: C API). Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.0: 3.7
CVSS v2.0: 4.3
GHSA-fx63-8q93-pfr5: The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive.  NOTE: this issue is caused by a CVE-2006-4334 regression.
CVE-2021-29868: IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 206213.
CVSS v3.0: 4
CVE-2019-15700: public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2008-0169: Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence.
CVSS v2.0: 6.8
GHSA-ghvr-mww9-3hrg: Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21; MongoDB Server v4.2 versions prior to 4.2.10;
CVSS v3.1: 5.3
GHSA-vcmw-4q9q-gx59: Buffer overflow in SysVInit in Red Hat Linux 5.1 and earlier allows local users to gain privileges.
GHSA-fvqq-gr4j-pf2q: An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0984.
CVSS v3.0: 7.8
GHSA-4v65-2p65-mvwf: ftpd.c in wu-ftpd 2.6.2, when running on "operating systems that only allow one non-connected socket bound to the same local address," does not close failed connections, which allows remote attackers to cause a denial of service.
RHSA-2018:3833: Red Hat Security Advisory: firefox security update
Mozilla: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4 firefox: Memory corruption in Angle Mozilla: Use-after-free with select element Mozilla: Buffer overflow in accelerated 2D canvas with Skia Mozilla: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs Mozilla: Integer overflow when calculating buffer sizes for images
CVSS v3.0: 9.8
CVE-2021-26529: The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
CVE-2016-1478: Cisco IOS 15.5(3)S3, 15.6(1)S2, 15.6(2)S1, and 15.6(2)T1 does not properly dequeue invalid NTP packets, which allows remote attackers to cause a denial of service (interface wedge) by sending many crafted NTP packets, aka Bug ID CSCva35619.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
GHSA-74qm-66r3-mxx7: Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (application crash) via multiple vectors, involving (1) a malformed message sent to an "Out Of Office" agent (SPR LPEE6DMQWJ), (2) the compact command (RTIN5U2SAJ), (3) malformed bitmap images (MYAA6FH5HW), (4) the "Delete Attachment" action (YPHG6844LD), (5) parsing certificates from a remote Certificate Table (AELE6DZFJW), and (6) creating a SSL key ring with the Domino Administration client (NSUA4FQPTN).
RHSA-2014:0419: Red Hat Security Advisory: kernel security and bug fix update
kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk
CVE-2023-6318: Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service
A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.

Full versions and TV models affected:

  *  webOS 5.5.0 - 04.50.51 running on OLED55CXPUA 

  *  webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB 

  *  webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA


CVSS v3.1: 9.1
CVE-2018-12610: OX App Suite 7.8.4 and earlier allows Information Exposure.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-7jc4-w8g6-3f8v: Unrestricted Upload of File with Dangerous Type vulnerability in Wibergs Web CSV to html allows Upload a Web Shell to a Web Server.This issue affects CSV to html: from n/a through 3.04.
CVSS v3.1: 9.9
GHSA-p3pr-m5x9-h46h: Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6 allow user-assisted remote attackers to execute arbitrary code via a long (1) function name or (2) symbol in a source-code file.
CVE-2021-26739: SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2019-4194: IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete authorized resources. IBM X-Force ID: 159033.
CVSS v3.0: 5.3
GHSA-h7f4-3733-vwrh: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27
CVSS v3.1: 4.8
GHSA-h89m-r85h-9g37: A Permissions, Privileges, and Access Control vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to delete an arbitrary file.
CVSS v3.0: 6.5