ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-mr6f-h57v-rpj5: Improper Validation of Query Parameters in Auth0 Next.js SDK
DescriptionAn input-validation flaw in the returnTo parameter in the Auth0 Next.js SDK could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parametersAm I Affected?You are affected if you meet the following preconditions:Applications using the auth0/nextjs-auth0 SDK version prior to 4.13.0Affected product and versionsAuth0/nextjs-auth0 versions >= 4.9.0 and < 4.13.0ResolutionUpgrade Auth0/nextjs-auth0 version to v4.13.0AcknowledgementsOkta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.
CVSS v3.1: 3.7
GHSA-9q3x-qq6c-v6jx: Adobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2017-9516: Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
GHSA-5wgc-72m9-67mg: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2026-53296: mailbox: mailbox-test: free channels on probe error
In the Linux kernel, the following vulnerability has been resolved:

mailbox: mailbox-test: free channels on probe error

On probe error, free the previously obtained channels. This not only
prevents a leak, but also UAF scenarios because the client structure
will be removed nonetheless because it was allocated with devm.
GHSA-pgwq-w27q-qg7f: Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 3.3
CVE-2024-34201: TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the getSaveConfig function.
CVSS v3.1: 7.3
CVE-2025-6454: Server-Side Request Forgery (SSRF) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.
CVSS v3.1: 8.5
GHSA-797w-wc59-pw29: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9742.
CVSS v3.1: 9.8
GHSA-m4wf-cgh7-9gv4: Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
GHSA-rgp2-hcwm-2v42: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26400.
CVSS v3.0: 7.8
CVE-2025-69983: FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.
CVSS v3.1: 8.2
CVE-2021-0695: In get_sock_stat of xt_qtaguid.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-184018316References: Upstream kernel
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-hm6h-mcgv-h2x8: Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail
CVSS v3.1: 4.9
CVE-2023-49144: Out of bounds read in OpenBMC Firmware for some Intel(R) Server Platforms before versions egs-1.15-0, bhs-0.27 may allow a privileged user to potentially enable information disclosure via local access.
CVSS v4.0: 8.1
CVSS v3.1: 6.7
CVE-2018-15752: An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. Cleartext Transmission of Sensitive Information allows man-in-the-middle attackers to eavesdrop authentication information between the application and the server.
CVSS v3.0: 8.1
CVSS v2.0: 4.3
GHSA-pf33-mp3w-9986: Unspecified vulnerability in the LDAP dissector in Wireshark (formerly Ethereal) 0.99.3 allows remote attackers to cause a denial of service (crash) via a crafted LDAP packet.
CVE-2025-46173: code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form.
CVSS v3.1: 6.1
GHSA-prgc-j9w5-pjpp: MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.
GHSA-rvgx-rpj5-2pcr: Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.
CVSS v3.1: 7.5
GHSA-46qx-wwvq-35pg: Multiple integer overflows in Hancom Office 2010 SE 8.5.5 allow remote attackers to execute arbitrary code via large dimension values in a (1) JPG image to the ImportGR in the JPG image filter module (HncJpeg10.flt) or (2) PNG image to the PNG image filter module (HncPng10.flt), which triggers a heap-based buffer overflow.
CVE-2025-22573: WordPress Icons Enricher plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in copist Icons Enricher icons-enricher allows Stored XSS.This issue affects Icons Enricher: from n/a through <= 1.0.8.
CVSS v3.1: 6.5
CVE-2013-2119: Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
CVSS v2.0: 4.6
GHSA-jc5f-hg7h-pwh2: IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 132611.
CVSS v3.0: 7.5
CVE-2022-2858: Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via specific UI interaction.
CVSS v3.1: 8.8
CVE-2025-13984: Next.js - Critical - Access bypass - SA-CONTRIB-2025-122
Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.
CVSS v3.1: 6.1
CVE-2024-47019: In ProtocolEmbmsSaiListAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation.
CVSS v3.1: 5.5
GHSA-jx7f-v5r5-55j4: The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.
CVSS v3.1: 7.5
CVE-2024-53505: A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.
CVSS v3.1: 9.8
RHSA-2016:2927: Red Hat Security Advisory: rh-mariadb100-mariadb security update
mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU October 2016) mysql: Incorrect input validation allowing code execution via mysqldump mysql: unspecified vulnerability in subcomponent: Server: DML (CPU October 2016) mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016) mysql: unspecified vulnerability in subcomponent: Server: DML (CPU October 2016) mysql: unspecified vulnerability in subcomponent: Server: GIS (CPU October 2016) mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU October 2016) mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU October 2016) mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016) mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016) mysql: unspecified vulnerability in subcomponent: Server: Types (CPU October 2016) mysql: Incorrect input validation allowing code execution via mysqldump mysql: Client mysqldump unspecified vulnerability (CPU Jul 2017)
CVSS v3.0: 4.3
GHSA-fpg4-jhqr-589c: SvelteKit  has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)
Some relatively small inputs can cause very large files arrays in `form` handlers. If the SvelteKit application code doesn't check `files.length` or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.Only users with `experimental.remoteFunctions: true` who are using the `form` function and are processing the `files` array without validation are vulnerable.
CVSS v4.0: 1.7
GHSA-gxx5-7x36-j997: Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issue was fixed with Avira Security version 1.1.78
CVSS v3.1: 4.4
GHSA-p5cp-vqjq-6cj7: FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packet_parser_ng.cpp, after validating that the packet contains at least sizeof(ipv4_header_t) bytes (20 bytes), the code advances the local_pointer by '4 * ipv4_header->get_ihl()' (line 164) without validating that (a) IHL >= 5 (the minimum valid value per RFC 791), or (b) 4 * IHL bytes are actually available in the packet. The IHL field is 4 bits, allowing values 0-15, so the advance can be 0-60 bytes. An IHL value of 15 with only 20 bytes validated causes a 40-byte over-read. An IHL of 0-4 causes the pointer to not advance past the IP header, resulting in the TCP/UDP header being parsed from IP header data (type confusion). This vulnerability is reachable via any packet capture interface.
CVSS v3.1: 5.9
GHSA-fxwp-mh6r-g9mm: clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$.
CVSS v3.0: 5.5
GHSA-648v-44jr-95mp: Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v4.0: 8.7
CVSS v3.1: 8.2
CVE-2025-60134: WordPress WP Media Categories Plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media Categories: from n/a through <= 2.1.0.
CVSS v3.1: 4.3
CVE-2016-0906: The web-restore interface in Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar through 7.1.2 and 7.2.x through 7.2.1 allows remote authenticated users to read or delete directories via a Linux backup-restore operation.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2007-2753: RunawaySoft Haber portal 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for data/xice.mdb.
CVSS v2.0: 5
CVE-2024-21216: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1: 9.8
CVE-2006-3349: Multiple SQL injection vulnerabilities in SmS Script allow remote attackers to execute arbitrary SQL commands via the CatID parameter in (1) cat.php and (2) add.php.
CVSS v2.0: 7.5
CVE-2018-0532: Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified vectors.
CVSS v3.0: 2.7
CVSS v2.0: 4
GHSA-v59r-47rm-ww8g: img/main.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote authenticated users to read arbitrary files in img/ via a filename in the next_file parameter, as demonstrated by reading .htpasswd to obtain the admin password, a different vulnerability than CVE-2004-2507.
CVE-2018-18874: nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=file_manager_upload URI.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-qcr4-m6wf-h33w: A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. This issue affects the function formAdvFirewall of the file /goform/formAdvFirewall. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-pxw2-p26j-qh83: RTPproxy through 2.2.alpha.20160822 has a NAT feature that results in not properly determining the IP address and port number of the legitimate recipient of RTP traffic, which allows remote attackers to obtain sensitive information or cause a denial of service (communication outage) via crafted RTP packets.
CVSS v3.0: 6.5
GHSA-fxgc-95xx-grvq: TensorFlow Denial of Service vulnerability
ImpactA malicious invalid input crashes a tensorflow model (Check Failed) and can be used to trigger a denial of service attack.
To minimize the bug, we built a simple single-layer TensorFlow model containing a Convolution3DTranspose layer, which works well with expected inputs and can be deployed in real-world systems. However, if we call the model with a malicious input which has a zero dimension, it gives Check Failed failure and crashes.This Convolution3DTranspose layer is a very common API in modern neural networks. The ML models containing such vulnerable components could be deployed in ML applications or as cloud services. This failure could be potentially used to trigger a denial of service attack on ML cloud services.PatchesWe have patched the issue inGitHub commit [948fe6369a5711d4b4568ea9bbf6015c6dfb77e2](https://github.com/tensorflow/tensorflow/commit/948fe6369a5711d4b4568ea9bbf6015c6dfb77e2)GitHub commit [85db5d07db54b853484bfd358c3894d948c36baf](https://github.com/keras-team/keras/commit/85db5d07db54b853484bfd358c3894d948c36baf).The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
CVSS v3.1: 6.5
CVE-2010-0290: Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains (1) CNAME or (2) DNAME records, which do not have the intended validation before caching, aka Bug 20737.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4022.
CVSS v2.0: 4
GHSA-3c4g-j683-8mx6: The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.
CVSS v3.1: 8.2
GHSA-w6pc-fvcc-hjc2: Improper data sanitization vulnerability in subsystem in Intel(R) SPS before versions SPS_E5_04.00.04.381.0, SPS_E3_04.01.04.054.0, SPS_SoC-A_04.00.04.181.0, and SPS_SoC-X_04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v3.0: 6.7
CVE-2017-7103: An issue was discovered in certain Apple products. iOS before 11 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Wi-Fi" component. It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via crafted Wi-Fi traffic.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-7x6x-63cg-vwxm: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2010-4898: SQL injection vulnerability in the Gantry (com_gantry) component 3.0.10 for Joomla! allows remote attackers to execute arbitrary SQL commands via the moduleid parameter to index.php.
CVSS v2.0: 7.5
GHSA-h75x-vhrr-wjrq: The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability.
CVSS v3.1: 7.5
GHSA-fwj8-62r8-8p8m: Incus has Nil-Pointer Dereference via S3 Bucket Import
SummaryMissing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file.DetailsIt was found that TransferManager.UploadAllFiles iterates over tar entries but only checks for io.EOF from tr.Next(). When tr.Next() returns a non-EOF error, such as unexpected EOF from a truncated archive, the header hdr is nil and the code continues to access hdr.Name, causing a nil-pointer dereference that panics the daemon.This may allow the Incus daemon to be crashed during S3 bucket restore if a truncated or corrupted backup archive is provided. A panic can occur when a malformed archive produces a non-EOF tar read error after the first entry. Any caller of UploadAllFiles that processes attacker-controlled archive content may be affected.Affected File:
[https://github.com/lxc/incus/blob/v6.22.0/…server/storage/s3/transfer_manager.go#L127](https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/s3/transfer_manager.go#L127)The tar-iteration loop only checks for EOF:Affected Code:When tr.Next() returns a non-EOF error, hdr is nil. The code does not check for this case and immediately dereferences hdr.Name.This was confirmed as follows:Command:Output:It is recommended to add a non-EOF error check after tr.Next().Proposed Fix:A patch is available at https://github.com/lxc/incus/releases/tag/v7.0.0.CreditsThis issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)
CVSS v3.1: 6.5
GHSA-q7h6-p78c-jfw4: A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege.
CVSS v4.0: 5.4
CVSS v3.1: 6.7
GHSA-3h9f-3qcx-pqf9: Unspecified vulnerability in Oracle Solaris 9 and 10, and OpenSolaris, allows local users to affect availability via unknown vectors related to Kernel/Filesystem.
CVE-2009-4073: The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a local pathname, and possibly a local username, by reading the dc:title element of a PDF document that was generated from a local web page.
CVSS v2.0: 5
CVE-2021-3881: Out-of-bounds Read in bfabiszewski/libmobi
libmobi is vulnerable to Out-of-bounds Read
CVSS v3.0: 7.1
CVE-2024-4508: Ruijie RG-UAC static_route_edit_ipv6.php os command injection
A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been classified as critical. Affected is an unknown function of the file /view/IPV6/ipv6StaticRoute/static_route_edit_ipv6.php. The manipulation of the argument oldipmask/oldgateway/olddevname leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263112. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 4.7
CVSS v3.0: 4.7
CVSS v2.0: 5.8
RHSA-2023:4153: Red Hat Security Advisory: bind security update
bind: named's configured cache size limit can be significantly exceeded
CVSS v3.1: 7.5
CVE-2020-12125: A remote buffer overflow vulnerability in the /cgi-bin/makeRequest.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary machine instructions as root without authentication.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-5hf6-7gxx-55wg: Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configuration Utility (DCCU), which allows privileged local users to change Computrace Agent's activation/deactivation status to the factory default via a crafted TaskResult.xml file.
CVSS v3.0: 4.1
CVE-2015-7778: Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks.
CVSS v3.0: 5.9
CVSS v2.0: 4.3
GHSA-97j3-hcxr-rx9m: Stack-based buffer overflow in Justsystem Ichitaro 9.x through 13.x, Ichitaro 2004, 2005, 2006, and Government 2006; Ichitaro for Linux; and FormLiner before 20060818 allows remote attackers to execute arbitrary code via long Unicode strings in a crafted document, as being actively exploited by malware such as Trojan.Tarodrop.  NOTE: some details are obtained from third party information.
CVE-2010-2930: Multiple stack-based buffer overflows in hsolinkcontrol in hsolink 1.0.118 allow local users to gain privileges via long command-line arguments, a different vulnerability than CVE-2010-1671.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.2
CVE-2015-1399: PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
CVSS v2.0: 6.5
CVE-2006-2671: SQL injection vulnerability in ChatPat 1.0 allows remote attackers to execute arbitrary SQL commands via the nickname field.
CVSS v2.0: 5
GHSA-g2w3-jpfv-qffv: An HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout and possibly execute a phishing attack via a crafted payload injected into a sent e-mail.
CVSS v3.1: 6.1