ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-gh4j-gqv2-49f6: fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped DelimitersSummaryfast-xml-parser XMLBuilder does not escape the `-->` sequence in comment content or the `]]>` sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation.Existing CVEs for fast-xml-parser cover different issues:CVE-2023-26920: Prototype pollution (parser)CVE-2023-34104: ReDoS (parser)CVE-2026-27942: Stack overflow in XMLBuilder with preserveOrderCVE-2026-25896: Entity encoding bypass via regex in DOCTYPE entitiesThis finding covers **unescaped comment/CDATA delimiters in XMLBuilder** - a distinct vulnerability.Vulnerable Code**File**: `src/fxb.js`Compare with attribute/text escaping which IS properly handled via `replaceEntitiesValue()`.Proof of ConceptTest 1: Comment Injection (XSS in SVG/HTML context)**Output**:Test 2: CDATA Injection (RSS feed)**Output**:Test 3: SOAP Message Injection**Output**:The injected `<Action>deleteAll</Action>` appears as a real SOAP action element.Tested OutputAll tests run on Node.js v22, fast-xml-parser v5.5.12:ImpactAn attacker who controls data that flows into XML comments or CDATA sections via XMLBuilder can:**XSS**: Inject `<script>` tags into XML/SVG/HTML documents served to browsers**SOAP injection**: Modify SOAP message structure by injecting XML elements**RSS/Atom feed poisoning**: Inject scripts into RSS feed items via CDATA breakout**XML document manipulation**: Break XML structure by escaping comment/CDATA contextThis is practically exploitable whenever applications use XMLBuilder to generate XML from data that includes user-controlled content in comments or CDATA (e.g., RSS feeds, SOAP services, SVG generation, config files).Suggested FixEscape delimiters in comment and CDATA content:
CVSS v3.1: 6.1
CVE-2024-30074: Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
CVSS v3.1: 8
CVE-2020-5264: Reflected XSS in security compromised page of PrestaShop
In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page. It allows anyone to execute arbitrary action. The problem is patched in the 1.7.6.5.
CVSS v3.1: 4.4
RHSA-2014:1020: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 update
httpd: mod_deflate denial of service netty: DoS via memory exhaustion during data aggregation httpd: mod_status heap-based buffer overflow Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter httpd: mod_cgid denial of service WS: Incomplete fix for CVE-2013-2133 Security: Invalid EJB caller role check implementation
CVE-2023-29584: mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the MP4GetVideoProfileLevel function at /src/mp4.cpp.
CVSS v3.1: 8.8
CVE-2026-1734: Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization
A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file crmeb/app/api/controller/v1/CrontabController.php of the component crontab Endpoint. The manipulation results in missing authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2025-30559: WordPress Kento WordPress Stats plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Kento WordPress Stats kento-wp-stats allows Stored XSS.This issue affects Kento WordPress Stats: from n/a through <= 1.1.
CVSS v3.1: 7.1
GHSA-g353-mgv3-8pcj: OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
SummaryFeishu webhook mode allowed deployments that configured only `verificationToken` without `encryptKey`. In that state, forged inbound events could be accepted because the weaker configuration did not provide the required cryptographic verification boundary.ImpactAn unauthenticated network attacker who could reach the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution subject to the local agent policy.Affected versions`openclaw` `<= 2026.3.11`PatchFixed in `openclaw` `2026.3.12`. Feishu webhook mode now fails closed unless `encryptKey` is configured, and the webhook transport rejects missing or invalid signatures before dispatch. Update to `2026.3.12` or later and configure `encryptKey` for webhook deployments.
CVSS v3.1: 8.6
CVE-2021-24837: Passster < 3.5.5.8 - Contributor+ Stored Cross-Site Scripting
The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
CVSS v3.1: 5.4
CVE-2024-28100: Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw
eLabFTW is an open source electronic lab notebook for research labs. By uploading specially crafted files, a regular user can create a circumstance where a visitor's browser runs arbitrary JavaScript code in the context of the eLabFTW application. This can be triggered by the visitor viewing a list of experiments. Viewing this allows the malicious script to act on behalf of the visitor in any way, including the creation of API keys for persistence, or other options normally available to the user. If the user viewing the page has the sysadmin role in eLabFTW, the script can act as a sysadmin (including system configuration and extensive user management roles). Users are advised to upgrade to at least version 5.0.0. There are no known workarounds for this vulnerability.
CVSS v3.1: 8.9
CVE-2023-4912: Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input.
CVSS v3.1: 2.6
CVE-2016-0725: Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-w2gm-mvph-w2q7: Unspecified vulnerability in Microsoft Visual Basic (VB) 6 has an unknown impact ("overflow") via a project that contains a certain Click event procedure, as demonstrated using the msgbox function and the VB.Label object.
GHSA-j48m-433v-3q7r: D-Link DSL-3788 revA1 1.01R1B036_EU_EN is vulnerable to Buffer Overflow via the COMM_MAKECustomMsg function of the webproc cgi
CVSS v3.1: 7.5
GHSA-x9r9-f377-wm64: PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\check_availability.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.
CVSS v3.1: 7.5
GHSA-h53w-5gqf-q8r2: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno (0.8.6 - 0.8.8; Android).
CVSS v3.0: 5.9
GHSA-g2cc-9fq5-9xww: Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unprotected action.
CVSS v3.1: 5.5
GHSA-m2jw-qr8p-cx48: Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd URI.
CVSS v3.0: 9.8
GHSA-rhcr-x3w4-7v5m: track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.
CVSS v3.1: 6.5
CVE-2000-1242: The HTTP service in American Power Conversion (APC) PowerChute uses a default username and password, which allows remote attackers to gain system access.
CVSS v2.0: 9
CVE-2022-49144: io_uring: fix memory leak of uid in files registration
In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix memory leak of uid in files registration

When there are no files for __io_sqe_files_scm() to process in the
range, it'll free everything and return. However, it forgets to put uid.
CVSS v3.1: 5.5
GHSA-34m7-5gf2-rcmj: RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a Windows Named Pipe were not sufficient to prevent access by unauthorized users. The attacker with local access to the system can exploit this vulnerability to read configuration properties for the authentication agent.
CVSS v3.0: 5.5
GHSA-q4c4-449g-h5hc: The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. This occurs because it accepts unencrypted 2.4 GHz packets, even though all legitimate communication uses AES encryption.
CVSS v3.0: 9.6
GHSA-fhgc-2x58-cm2p: The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multiple votes for a candidate via a crafted RFID ballot tag.
CVSS v3.0: 4.6
GHSA-76mh-6w46-rwcg: rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element.
CVSS v3.0: 6.1
GHSA-8f7g-f5q3-fc3x: Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.
CVSS v3.1: 6.5
CVE-2018-10893: Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code.
CVSS v3.0: 7.6
GHSA-8fxj-9pc3-pv45: The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
CVSS v3.1: 6.1
PYSEC-2021-579: TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToVariant`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L129) has an incomplete validation of the splits values, missing the case when the argument would be empty. We have patched the issue in GitHub commit be7a4de6adfbd303ce08be4332554dff70362612. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVE-2022-20366: In ioctl_dpm_clk_update of lwis_ioctl.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-225877745References: N/A
CVSS v3.1: 6.7
CVE-2025-24773: WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows SQL Injection.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through <= 3.2.0.
CVSS v3.1: 9.3
CVE-2014-3009: The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct phishing attacks via a crafted web site.
CVSS v2.0: 3.5
CVE-2014-8373: The VMware Remote Console (VMRC) function in VMware vCloud Automation Center (vCAC) 6.0.1 through 6.1.1 allows remote authenticated users to gain privileges via vectors involving the "Connect (by) Using VMRC" function.
CVSS v2.0: 9
GHSA-pjpr-cxv3-7hv5: PHPNetToolpack 0.1 allows remote attackers to execute arbitrary code via shell metacharacters in the a_query variable.
CVE-2018-25084: Ping Identity Self-Service Account Manager SSAMController.java cross site scripting
A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is some unknown functionality of the file src/main/java/com/unboundid/webapp/ssam/SSAMController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.1.3 is able to address this issue. The patch is identified as f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251. It is recommended to upgrade the affected component. VDB-225362 is the identifier assigned to this vulnerability.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-8mm2-m2gp-c6x2: Moodle Improper Access Control vulnerability
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
CVSS v3.1: 4.3
GHSA-q3p9-8728-wq7x: Drupal saving user accounts can sometimes grant the user all roles
The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.
CVSS v3.0: 8.1
GHSA-2874-9wc2-224f: ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.
CVSS v3.0: 7.8
CVE-2022-37032: An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.
CVSS v3.1: 9.1
RHSA-2024:8856: Red Hat Security Advisory: kernel security update
kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create kernel: gso: do not skip outer ip header in case of ipip and net_failover kernel: cifs: fix oops during encryption kernel: dmaengine: fix NULL pointer in channel unregistration function kernel: memcontrol: ensure memcg acquired by id is properly set up kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range kernel: netfilter: nft_set_pipapo: do not free live element kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump kernel: nouveau: lock the client object tree. kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() kernel: dma-direct: Leak pages on dma_set_decrypted() failure kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq kernel: of: module: add buffer overflow check in of_modalias() kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. kernel: net/mlx5e: Fix netif state handling kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type kernel: drm/i915/dpt: Make DPT object unshrinkable kernel: ipv6: prevent possible NULL deref in fib6_nh_init() kernel: tipc: force a dst refcount before doing decryption kernel: ACPICA: Revert &#34;ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.&#34; kernel: bpf: Fix overrunning reservations in ringbuf kernel: netfilter: nf_tables: prefer nft_chain_validate kernel: ibmvnic: Add tx check to prevent skb leak kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers kernel: drm/amdgpu: avoid using null object of framebuffer kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush kernel: USB: serial: mos7840: fix crash on resume kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error kernel: kobject_uevent: Fix OOB access within zap_modalias_env() kernel: dev/parport: fix the array out-of-bounds risk kernel: block: initialize integrity buffer to zero before writing it to media kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() kernel: memcg: protect concurrent access to mem_cgroup_idr kernel: sctp: Fix null-ptr-deref in reuseport_add_sock(). kernel: bonding: fix xfrm real_dev null pointer dereference kernel: bonding: fix null pointer deref in bond_ipsec_offload_ok kernel: netfilter: flowtable: initialise extack before use kernel: ethtool: check device is present when getting link settings kernel: ELF: fix kernel.randomize_va_space double read kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
CVSS v3.1: 4.7
GHSA-rmp2-65m7-997j: VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/onvif/device_service).
CVSS v3.0: 8.8
GHSA-p3j6-f45h-hw5f: tiagorlampert CHAOS vulnerable to command injections
An issue in tiagorlampert CHAOS v5.0.1 allows a remote attacker to execute arbitrary code via the BuildClient function within client_service.go
CVSS v3.1: 8.8
GHSA-j5jq-r673-59h3: In the Linux kernel, the following vulnerability has been resolved:drm/xe/sync: Fix user fence leak on alloc failureWhen dma_fence_chain_alloc() fails, properly release the user fence
reference to prevent a memory leak.(cherry picked from commit a5d5634cde48a9fcd68c8504aa07f89f175074a0)
CVSS v3.1: 5.5
GHSA-j552-6vv5-6jv4: A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content.
CVSS v3.1: 5.4
GHSA-939c-3g97-vpvv: Withdrawn Advisory: Access control issues in blackbox_exporter
Withdrawn AdvisoryThis advisory has been withdrawn because it was determined to be a configuration issue rather than a vulnerability. This link is maintained to preserve external references. For more information, see the conversation [here](https://github.com/prometheus/blackbox_exporter/issues/1024#issuecomment-1449145854).Original Advisoryblackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources.
CVSS v3.1: 7.5
CVE-2014-4056: Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2.0: 9.3
CVE-2022-4640: Mingsoft MCMS Article save cross site scripting
A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Article Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216499.
CVSS v3.1: 3.5
RHSA-2016:0101: Red Hat Security Advisory: java-1.6.0-ibm security update
JDK: J9 JVM allows code to invoke non-public interface methods TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) libpng: Out-of-bounds read in png_convert_to_rfc1123 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions libpng: underflow read in png_check_keyword() OpenJDK: URL deserialization inconsistencies (Networking, 8059054) OpenJDK: logging of RMI connection secrets (JMX, 8130710) OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)
CVSS v3.0: 7.6
GHSA-jh73-2gqf-9g2h: The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to import settings via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 8.8
GHSA-2g22-654r-vjqg: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper validation of array index in WMA roam synchronization handler can lead to OOB write.
CVSS v3.0: 7.8
RHSA-2023:7747: Red Hat Security Advisory: libxml2 security update
libxml2: crafted xml can cause global buffer overflow
CVSS v3.1: 6.5
CVE-2025-54314: Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."
CVSS v3.1: 2.8
GHSA-2fx5-pggv-6jjr: TYPO3 Potential Open Redirect via Parsing Differences
ProblemApplications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via a query parameter) and validate the host of the parsed URL may be vulnerable to open redirect or SSRF attacks if the URL is used after passing the validation checks.SolutionUpdate to TYPO3 versions 9.5.49 ELTS, 10.4.48 ELTS, 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS that fix the problem described.CreditsThanks to Sam Mush and Christian Eßl who reported this issue and to TYPO3 core & security team member Benjamin Franzke who fixed the issue.References[TYPO3-CORE-SA-2025-002](https://typo3.org/security/advisory/typo3-core-sa-2025-002)
CVSS v3.1: 4.8
GHSA-f5c9-gcjw-ghvw: The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users
CVSS v3.1: 4.3
GHSA-fcm3-cc23-mg3g: This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the access controls for the installed product files. The installation procedure leaves critical files open to manipulation by any authenticated user. An attacker can leverage this vulnerability to escalate privileges to SYSTEM. Was ZDI-CAN-5097.
CVSS v3.0: 7.8
GHSA-rpv2-rq4j-p9m3: SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file
CVSS v3.1: 7.8
GHSA-74hr-cpgh-6r4g: IBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that could execute arbitrary code on the system. IBM X-Force ID: 207633.
CVSS v3.1: 8.8