ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2023-33873: AVEVA Operations Control Logger Execution with Unnecessary Privileges 

This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.


CVSS v3.1: 7.8
GHSA-hjw7-2339-8v84: In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate escaping of file and folder names leads to XSS vulnerabilities in the template manager component.
CVSS v3.0: 6.1
CVE-2017-12645: XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2026-38532: A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.
CVSS v3.1: 8.1
CVE-2025-46592: Null pointer dereference vulnerability in the USB HDI driver module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 4.4
GHSA-rq88-x89h-6r64: Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.
CVE-2022-1365: Exposure of Private Personal Information to an Unauthorized Actor in lquixada/cross-fetch
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.
CVSS v3.0: 8.8
GHSA-9h8c-4wj7-59cr: Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.encryptfiles and guessing the correct image file extension.
CVSS v3.1: 2.1
GHSA-g734-9m5h-rq2w: SQL injection vulnerability in authordetail.php in Article Friendly Pro allows remote attackers to execute arbitrary SQL commands via the autid parameter.
CVE-2008-6589: Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) index.php and (2) LightNEasy.php.
CVSS v2.0: 4.3
CVE-2025-26986: WordPress Pearl Theme < 3.4.8 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Pearl - Corporate Business pearl allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a through < 3.4.8.
CVSS v3.1: 8.1
CVE-2023-40375: IBM i privilege escalation
Integrated application server for IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability.  A malicious actor with command line access to the host operating system can elevate privileges to gain root access to the host operating system.  IBM X-Force ID:  263580.
CVSS v3.1: 7.4
CVE-2005-2626: Unspecified vulnerability in Kismet before 2005-08-R1 allows remote attackers to have an unknown impact via unprintable characters in the SSID.
CVSS v2.0: 10
GHSA-pw36-hxw6-v2x3: Missing Authorization vulnerability in ONTRAPORT PilotPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PilotPress: from n/a through 2.0.35.
CVSS v3.1: 4.3
CVE-2020-9007: Codoforum 4.8.8 allows self-XSS via the title of a new topic.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2023-27868: IBM Db2 code execution
IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially crafted request using the named pluginClassName class, an attacker could exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force ID:  249516.
CVSS v3.1: 6.3
CVE-2022-30399: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_category&id=.
CVSS v3.1: 7.2
CVSS v2.0: 6.5
CVE-2019-9617: An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadFile URI.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
RHSA-2019:3135: Red Hat Security Advisory: java-11-openjdk security update
OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518) OpenJDK: Out of bounds access in optimized String indexof implementation (Hotspot, 8224062) OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765)
CVSS v3.1: 4.8
CVSS v3.0: 4.7
CVE-2009-4915: Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to cause a denial of service (device reload) via unknown network traffic, as demonstrated by a "connection stress test," aka Bug ID CSCsq68451.
CVSS v2.0: 7.8
GHSA-rq2v-wcr2-phxj: SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting
GHSA-cpw9-rv4g-g54v: Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.
CVSS v3.1: 7.1
CVE-2021-45658: Certain NETGEAR devices are affected by server-side injection. This affects D7800 before 1.0.1.58, DM200 before 1.0.0.66, EX2700 before 1.0.1.56, EX6150v2 before 1.0.1.86, EX6100v2 before 1.0.1.86, EX6200v2 before 1.0.1.78, EX6250 before 1.0.0.110, EX6410 before 1.0.0.110, EX6420 before 1.0.0.110, EX6400v2 before 1.0.0.110, EX7300 before 1.0.2.144, EX6400 before 1.0.2.144, EX7320 before 1.0.0.110, EX7300v2 before 1.0.0.110, R7500v2 before 1.0.3.48, R7800 before 1.0.2.68, R8900 before 1.0.5.2, R9000 before 1.0.5.2, RAX120 before 1.0.1.90, RBK40 before 2.5.1.16, RBK20 before 2.5.1.16, RBR20 before 2.5.1.16, RBS20 before 2.5.1.16, RBK50 before 2.5.1.16, RBR50 before 2.5.1.16, RBS50 before 2.5.1.16, RBS50Y before 2.6.1.40, WN3000RPv2 before 1.0.0.78, WN3000RPv3 before 1.0.2.80, WNR2000v5 before 1.0.0.72, XR500 before 2.3.2.56, and XR700 before 1.0.1.20.
CVSS v3.1: 7.1
GHSA-xrch-m74q-rcf4: The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Stored Cross-site scripting attacks.
CVSS v3.1: 4.8
CVE-2022-20438: In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242259920
CVSS v3.1: 5.5
GHSA-65m4-vmhq-5x4j: Cross-site scripting (XSS) vulnerability in pages/news.page.inc in Project Alumni 1.0.9 allows remote attackers to inject arbitrary web script or HTML via the year parameter in a news action to index.php, a different vector than CVE-2007-6126.
CVE-2016-9731: IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
CVE-1999-0011: Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer.
CVSS v3.1: 5.4
CVSS v2.0: 10
CVE-2023-20071: Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a flaw in the FTP module of the Snort detection engine. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and deliver a malicious payload.
CVSS v3.1: 5.8
RHSA-2019:1587: Red Hat Security Advisory: python security update
python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
CVSS v3.0: 9.8
CVE-2016-20081: WordPress Plugin HB Audio Gallery Lite 1.0.0 Path Traversal File Download
WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-228g-948r-83gx: Improper neutralization of data URIs may allow XSS in Loofah
SummaryLoofah `>= 2.1.0, < 2.19.1` is vulnerable to cross-site scripting via the `image/svg+xml` media type in data URIs.MitigationUpgrade to Loofah `>= 2.19.1`.SeverityThe Loofah maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).References[CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)[SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg](https://github.com/w3c/svgwg/issues/266)https://hackerone.com/reports/1694173https://github.com/flavorjones/loofah/issues/101CreditThis vulnerability was responsibly reported by Maciej Piechota (@haqpl).
CVSS v3.1: 6.1
CVE-2005-2954: SQL injection vulnerability in password_reminder.php in ATutor before 1.5.1 pl1 allows remote attackers to execute arbitrary SQL commands via the email field.
CVSS v2.0: 7.5
CVE-2024-20291: A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device.
 This vulnerability is due to incorrect hardware programming that occurs when configuration changes are made to port channel member ports. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access network resources that should be protected by an ACL that was applied on port channel subinterfaces.
CVSS v3.1: 5.8
CVE-2025-61982: An arbitrary code execution vulnerability exists in the Code Stream directive functionality of OpenCFD OpenFOAM 2506. A specially crafted OpenFOAM simulation file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS v3.1: 7.8
CVE-2025-26534: WordPress Helloprint Plugin <= 2.0.7 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This issue affects Helloprint: from n/a through <= 2.0.7.
CVSS v3.1: 8.6
CVE-2024-26226: Windows Distributed File System (DFS) Information Disclosure Vulnerability
Windows Distributed File System (DFS) Information Disclosure Vulnerability
CVSS v3.1: 6.5
CVE-2025-32697: Cascading protection is not preventing file reversions
Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/IntroMessageBuilder.Php, includes/Permissions/PermissionManager.Php, includes/Permissions/RestrictionStore.Php.

This issue affects MediaWiki: before 1.42.6, 1.43.1.
CVSS v4.0: 0
CVE-2019-0343: SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2023-50983: Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.
CVSS v3.1: 9.8
GHSA-wmjp-jcfp-7jf8: Format string vulnerability in exim (3.22-10 in Red Hat, 3.12 in Debian and 3.16 in Conectiva) in batched SMTP mode allows a remote attacker to execute arbitrary code via format strings in SMTP mail headers.
GHSA-h72v-g53g-mw9x: A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to super_admin via restoring modified configurations.
CVSS v3.1: 7.2
GHSA-q88p-27gr-q4g5: Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking.This issue affects E-Commerce Website: before 4.5.001.
CVSS v3.1: 9.8
GHSA-q6fj-qvhw-x524: SQL injection vulnerability in dreamnews-rss.php in DreamNews Manager allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2026-57953: Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventing_import_automatic_webhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can exploit this misconfigured access control to create and delete automation workflows, making unauthorized modifications to operation automation configuration and EventGroups.
CVSS v4.0: 5.3
CVSS v3.1: 5.4
GHSA-w7qc-6grj-w7r8: File Browser vulnerable to command execution allowlist bypass
SummaryThe *Command Execution* feature of Filebrowser only allows the execution of shell command which have been predefined on a user-specific allowlist. The implementation of this allowlist is erroneous, allowing a user to execute additional commands not permitted.ImpactA user can execute more shell commands than they are authorized for. The concrete impact of this vulnerability depends on the commands configured, and the binaries installed on the server or in the container image. Due to the missing separation of *scopes* on the OS-level, this could give an attacker access to all files managed the application, including the File Browser database.Vulnerability DescriptionFor a user to make use of the command execution feature, two things need to happen in advance:An administrator needs to grant that account the `Execute commands` permissionThe command to be executed needs to be listed in the `Commands` input field (also done by an administrator)If a user tries to execute a different command, it gets rejected by the application.The allowlist verification of a command happens in the function `CanExecute` in the file `users/users.go`:This check employs a regular expression which does not test if the command issued (`command`) is identical to a configured one (`cmd`, part of the array `u.Commands`) but rather only if the issued command contains an allowed one.
This has the consequence, that, e.g., if you are only granted access to the `ls` command, you will also be allowed to execute `lsof` and `lsusb`.As a prerequisite, an attacker needs an account with the `Execute Commands` permission and some permitted commands.Proof of ConceptGrant a user the `Execute commands` permission and allow them to use only `ls` in the `Commands` field.![image](https://github.com/user-attachments/assets/30b84315-16bd-4b8f-ba30-2a395c89f002)Afterwards, login as that user, open a command execution window and execute `lsof` and `lsusb`.![image](https://github.com/user-attachments/assets/f40baf90-832e-4ced-a596-bc75cf691549)Recommended CountermeasuresThe `CanExecute` function in the *Filebrowser* source code should be fixed to only allow exact matches of the command specified instead of doing partial matching.
The correctness of this fix should be extensively tested in the application's automated test suite.Timeline`2025-03-25` Identified the vulnerability in version 2.32.0`2025-04-11` Contacted the project`2025-04-18` Vulnerability disclosed to the project`2025-06-25` Uploaded advisories to the project's GitHub repository`2025-06-25` CVE ID assigned by GitHub`2025-06-26` Fix released in version 2.33.10References[Original Advisory](https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-05_Filebrowser_Bypass_Command_Execution_Allowlist)CreditsMathias Tausig ([SBA Research](https://www.sba-research.org/))
CVSS v3.1: 8
CVE-2021-39628: In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-189575031
CVSS v3.1: 3.3
CVSS v2.0: 2.1
GHSA-rmxg-rxm9-f8vx: Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Integer Truncation Privilege Escalation vulnerability which could allow a local attacker to trigger a buffer overflow and escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2008-0460: Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
GHSA-rv25-9wgj-xg75: Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint
It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. However Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.
CVSS v4.0: 5.3
CVSS v3.0: 6.1
CVE-2021-21200: Out of bounds read in WebUI Settings in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chrome security severity: Low)
CVSS v3.1: 5.4
GHSA-fvhw-xrfv-jv2r: SQL injection vulnerability in the RSS feed from records extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
GHSA-ppm8-x2wc-89pm: Unspecified vulnerability in sapstartsrv.exe in the SAP Kernel 6.40, 7.00, 7.01, 7.10, 7.11, and 7.20, as used in SAP NetWeaver 7.x and SAP Web Application Server 6.x and 7.x, allows remote attackers to cause a denial of service (Management Console shutdown) via a crafted request. NOTE: some of these details are obtained from third party information.
GHSA-m5m8-2949-56mc: Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484.
GHSA-gg8r-xjwq-4w92: Cross-site scripting vulnerability in TinyMCE alerts
ImpactA cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the `image` plugin, which presents these dialogs when certain errors occur. The vulnerability allowed arbitrary JavaScript execution when an alert presented in the TinyMCE UI for the current user.PatchesThis vulnerability has been patched in TinyMCE 5.10.7 and TinyMCE 6.3.1 by ensuring HTML sanitization was still performed after unwrapping invalid elements.FixTo avoid this vulnerability:Upgrade to TinyMCE 5.10.7 or higher for TinyMCE 5.x.Upgrade to TinyMCE 6.3.1 or higher for TinyMCE 6.x.WorkaroundTo reduce the impact of this vulnerability:Ensure the the `images_upload_handler` returns a valid value as per the images_upload_handler documentation.Referenceshttps://www.tiny.cloud/docs/release-notes/release-notes5107/#securityfixeshttps://www.tiny.cloud/docs/tinymce/6/6.3-release-notes/#security-fixesFor more informationIf you have any questions or comments about this advisory:Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
CVSS v3.1: 5.4
GHSA-wc2c-986f-h2pp: There is information disclosure.
CVSS v3.1: 7.5
CVE-2025-53028: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.1: 8.2
GHSA-rv26-4v2m-ch64: Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call.
CVSS v3.1: 6.4
CVE-2024-29042: Translate Cache Poisoning Vulnerability
Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served. Version 3.0.0 fixes this issue.
CVSS v3.1: 5.3
CVE-2026-14642: SourceCodester Class and Exam Timetabling System edit_class2.php sql injection
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /edit_class2.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2024-13879: Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery
The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
CVSS v3.1: 5.5