ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-6mqw-4pq7-h9fp: Adobe Shockwave versions 12.2.8.198 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 9.8
RHSA-2025:0334: Red Hat Security Advisory: ipa security update
freeipa: Administrative user data leaked through systemd journal
CVSS v3.1: 5.5
RHSA-2026:0420: Red Hat Security Advisory: OpenShift Container Platform 4.20.10 bug fix and security update
bind: Resource exhaustion via malformed DNSKEY handling openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap bind: Cache poisoning attacks with unsolicited RRs bind: Cache poisoning due to weak PRNG firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing
CVSS v3.1: 5.3
CVE-2025-68946: In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
CVSS v3.1: 5.4
RHSA-2025:3393: Red Hat Security Advisory: freetype security update
freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files
CVSS v3.1: 8.1
CVE-2026-45918: ovpn: tcp - don't deref NULL sk_socket member after tcp_close()
In the Linux kernel, the following vulnerability has been resolved:

ovpn: tcp - don't deref NULL sk_socket member after tcp_close()

When deleting a peer in case of keepalive expiration, the peer is
removed from the OpenVPN hashtable and is temporary inserted in a
"release list" for further processing.

This happens in:
ovpn_peer_keepalive_work()
  unlock_ovpn(release_list)

This processing includes detaching from the socket being used to
talk to this peer, by restoring its original proto and socket
ops/callbacks.

In case of TCP it may happen that, while the peer is sitting in
the release list, userspace decides to close the socket.
This will result in a concurrent execution of:

tcp_close(sk)
  __tcp_close(sk)
    sock_orphan(sk)
      sk_set_socket(sk, NULL)

The last function call will set sk->sk_socket to NULL.

When the releasing routine is resumed, ovpn_tcp_socket_detach()
will attempt to dereference sk->sk_socket to restore its original
ops member. This operation will crash due to sk->sk_socket being NULL.

Fix this race condition by testing-and-accessing
sk->sk_socket atomically under sk->sk_callback_lock.
CVE-2026-5756: Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS)
Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server's configuration file, potentially leading to mass data exfiltration, malicious traffic interception, or disruption of testing services.
CVSS v3.1: 7.5
CVE-2008-7195: Unspecified vulnerability in Fujitsu Interstage HTTP Server, as used in Interstage Application Server Enterprise Edition 7.0.1 for Solaris, allows attackers to cause a denial of service via unknown vectors related to SSL.
CVSS v2.0: 5
GHSA-57hj-9c9v-7vhc: annclist.exe in webTV for Windows allows remote attackers to cause a denial of service by via a large, malformed UDP packet to ports 22701 through 22705.
GHSA-92rh-3xpw-hjgg: NukeNabber allows remote attackers to cause a denial of service by connecting to the NukeNabber port (1080) without sending any data, which causes the CPU usage to rise to 100% from the report.exe program that is executed upon the connection.
GHSA-q4mm-89q2-xffg: phpMyAdmin vulnerable to XML external entity (XXE) injection attack
The `simplexml_load_string` function in the XML import plug-in (`libraries/import/xml.php`) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
CVSS v3.1: 6.5
RHSA-2024:3546: Red Hat Security Advisory: ruby:3.1 security, bug fix, and enhancement update
ruby: Buffer overread vulnerability in StringIO ruby: RCE vulnerability with .rdoc_options in RDoc ruby: Arbitrary memory address read vulnerability with Regex search
CVSS v3.1: 6.6
ICSA-23-306-06: Schneider Electric SpaceLogic C-Bus Toolkit
Schneider Electric's SpaceLogic C-Bus Toolkit product is vulnerable due to improper privilege management, which could cause remote code execution when the transfer command is used over the network. Schneider Electric's SpaceLogic C-Bus Toolkit product contains a path traversal vulnerability, which could cause tampering of files on the personal computer running C-Bus when using the File Command.
CVSS v3.1: 9.8
GHSA-gwcc-2364-w9p4: In the Linux kernel, the following vulnerability has been resolved:HID: cp2112: prevent a buffer overflow in cp2112_xfer()Smatch warnings:
drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy()
'data->block[1]' too small (33 vs 255)
drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too
small (64 vs 255)The 'read_length' variable is provided by 'data->block[0]' which comes
from user and it(read_length) can take a value between 0-255. Add an
upper bound to 'read_length' variable to prevent a buffer overflow in
memcpy().
CVSS v3.1: 7.8
CVE-2026-2540: Micca KE700 Acceptance of previously used rolling codes
The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previously used (stale) rolling codes and execute a command. Successful exploitation allows an attacker to clone the alarm key. This grants the attacker unauthorized access to the vehicle to unlock or lock the doors.
CVSS v4.0: 8.4
GHSA-gpc2-f62m-c6h6: Jenkins Code Dx Plugin stores API keys in plain text
Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.Additionally, the job configuration form does not mask these API keys, increasing the potential for attackers to observe and capture them.Code Dx Plugin 4.0.0 no longer stores the API keys directly, instead accessing them through its newly added Credentials Plugin integration. Affected jobs need to be reconfigured.
CVSS v3.1: 4.3
GHSA-4q9h-j8g6-f49h: KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large. As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit architectures.
CVSS v4.0: 8.6
GHSA-hhjf-9w4x-vhhf: locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.
RHSA-2024:0028: Red Hat Security Advisory: thunderbird security update
Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM driver Mozilla: Symlinks may resolve to smaller than expected buffers Mozilla: Heap buffer overflow in <code>nsTextFragment</code> Mozilla: Use-after-free in PR_GetIdentitiesLayer Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode Mozilla: Use-after-free in <code>nsDNSService</code> Mozilla: Undefined behavior in <code>ShutdownObserver()</code> Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6 Mozilla: S/MIME signature accepted despite mismatching message date Mozilla: Truncated signed text was shown with a valid OpenPGP signature
CVSS v3.1: 7.5
CVE-2025-3007: Novastar CX40 NetFilter Utility netconfig getopt stack-based overflow
A vulnerability was found in Novastar CX40 up to 2.44.0. It has been rated as critical. This issue affects the function getopt of the file /usr/nova/bin/netconfig of the component NetFilter Utility. The manipulation of the argument cmd/netmask/pipeout/nettask leads to stack-based buffer overflow. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.1
CVSS v3.1: 5.5
CVSS v3.0: 5.5
CVSS v2.0: 5.2
CVE-2013-7242: SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter.
CVSS v2.0: 6.5
GHSA-jmgx-hhrr-ppmv: Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.5.2.
CVSS v3.0: 4.3
GHSA-2q32-mvgg-6pfc: Improper Information in Cybersecurity Guidebook in Bosch Building Integration System (BIS) 5.0 may lead to wrong configuration which allows local users to access data via network
CVSS v3.1: 8.1
CVE-2024-12959: 1000 Projects Portfolio Management System MCA update_personal_details.php sql injection
A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /update_personal_details.php. The manipulation of the argument q leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
RHSA-2015:1330: Red Hat Security Advisory: python security, bug fix, and enhancement update
python: multiple unbound readline() DoS flaws in python stdlib python: buffer overflow in socket.recvfrom_into() python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs python: buffer() integer overflow leading to out of bounds read
CVE-2023-30150: PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
CVSS v3.1: 9.8
RHSA-2024:1319: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.8 release and security update
openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow tomcat: HTTP request smuggling via malformed trailer headers Tomcat: HTTP/2 header handling DoS
CVSS v3.1: 7.5
GHSA-pg6w-mg2w-j6wf: Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to conduct Open Redirect attacks via the return-url parameter to /goform/formLogout.
CVSS v3.0: 6.1
CVE-2022-4312: 

A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could
allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files
to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code.
Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email
account and SIM card.


CVSS v3.1: 5.5
CVE-2025-68047: WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3.
CVSS v3.1: 8.8
GHSA-hxqp-hf33-px7g: Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities that allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions. Attackers with access to an enabled Infinity network port or physical proximity to a wireless access point can modify device settings such as alarm states or alarm limits, and overwhelm the system with incoming data causing the device to reboot and lose network functionality.
CVSS v4.0: 8.8
CVSS v3.1: 8.6
GHSA-jc9g-p879-f3v9: Missing Authorization vulnerability in Peach Payments Peach Payments Gateway.This issue affects Peach Payments Gateway: from n/a through 3.1.9.
CVSS v3.1: 5.4
GHSA-wjwx-g228-98hp: Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0.
CVSS v3.1: 8.8
CVE-2026-46258: gpio: cdev: Avoid NULL dereference in linehandle_create()
In the Linux kernel, the following vulnerability has been resolved:

gpio: cdev: Avoid NULL dereference in linehandle_create()

In linehandle_create(), there is a statement like this:
  retain_and_null_ptr(lh);

Soon after, there is a debug printout that dereferences "lh", which
will crash things.

Avoid the crash by using handlereq.lines, which is the same value.
CVSS v3.1: 5.5
GHSA-h484-3rpg-f8cm: Unspecified vulnerability in MkPortal allows remote attackers to corrupt web site content, and possibly have other impact, via a certain long Message that affects "Tables," related to the Urlobox.
CVE-2017-14537: trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.
CVSS v3.1: 6.5
CVSS v2.0: 4
RHSA-2024:2779: Red Hat Security Advisory: nodejs:18 security update
nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service c-ares: Out of bounds read in ares__read_line() nodejs: HTTP Request Smuggling via Content Length Obfuscation nodejs: CONTINUATION frames DoS nghttp2: CONTINUATION frames DoS
CVSS v3.1: 5.3
CVE-2016-0589: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors.
CVSS v2.0: 6.4
GHSA-7qcj-ww2g-7w6j: An out-of-bounds write vulnerability exists in the Grassroots DICOM library (GDCM). The issue is triggered during parsing of a malformed DICOM file containing encapsulated PixelData fragments (compressed image data stored as multiple fragments). This vulnerability leads to a segmentation fault caused by an out-of-bounds memory access due to unsigned integer underflow in buffer indexing. It is exploitable via file input, simply opening a crafted malicious DICOM file is sufficient to trigger the crash, resulting in a denial-of-service condition.
CVSS v4.0: 6.8
CVSS v3.1: 6.6
GHSA-cp96-2fvh-r4w7: Unquoted Windows search path vulnerability in RealNetworks RealPlayer 10.5 6.0.12.1040 through 6.0.12.1348, RealPlayer 10, RealOne Player v2, RealOne Player v1, and RealPlayer 8 before 20060322 might allow local users to gain privileges via a malicious C:\program.exe file.
CVE-2018-25375: SocuSoft iPod Photo Slideshow 8.05 Buffer Overflow SEH
SocuSoft iPod Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft malicious input in the Registration Name and Registration Key fields to trigger a stack-based buffer overflow and execute a reverse shell payload.
CVSS v4.0: 8.6
CVSS v3.1: 8.4
GHSA-qfxh-25p2-5j9m: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12269.
CVE-2023-38459: In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
CVSS v3.1: 7.8
CVE-2023-31293: An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user's web browser, allowing the journal to be displayed, despite the option being disabled.
CVSS v3.1: 4.3
CVE-2025-55737: flaskBlog arbitrary comment delete
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py.
CVSS v4.0: 6.9
CVE-2026-14393: Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2025-7202: Cross-Site Request Forgery (CSRF) allowed remote control of Elgato Key Lights
A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that remotely controlles the victim's lights.
CVSS v4.0: 5.1
CVE-2017-5998: Cross-site scripting (XSS) vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject arbitrary web script or HTML via the str_log_name parameter in a "Web Admin Portal > Log Configuration > Add" action.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
GHSA-fhhr-6q8c-w2wf: A resource exhaustion issue was addressed with improved input validation. This issue is fixed in tvOS 12.1, iOS 12.1. Processing a maliciously crafted message may lead to a denial of service.
CVE-2023-30912: 

A remote code execution issue exists in HPE OneView.


CVSS v3.1: 7.2
GHSA-4g77-86xf-vfq8: This issue was addressed with improved entitlements. This issue is fixed in watchOS 6, tvOS 13, macOS Catalina 10.15, iOS 13. An application may be able to gain elevated privileges.
GHSA-rg2m-7v6j-w3wq: The authentication mechanism used by technicians on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery. An attacker with physical access may use this to gain administrative privileges on a device and install malicious code or perform arbitrary administrative actions.
CVSS v3.1: 6.8
GHSA-mpcj-733c-h3vq: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=save_client.
CVSS v3.1: 6.1
CVE-2026-4699: Incorrect boundary conditions in the Layout: Text and Fonts component
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVSS v3.1: 7.5
GHSA-p7w4-8576-mqwx: Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JP2 image.
GHSA-w4f4-x37j-q6j2: IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197504.
CVE-2025-39489: WordPress CouponXL theme <= 4.5.0 - Privilege Escalation Vulnerability
Incorrect Privilege Assignment vulnerability in pebas CouponXL couponxl allows Privilege Escalation.This issue affects CouponXL: from n/a through <= 4.5.0.
CVSS v3.1: 9.8
GHSA-grfr-pqc4-fqmw: Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.
CVSS v3.1: 9.8
CVE-2018-0708: Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2025-30988: WordPress Elite Video Player plugin <= 10.0.5 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Stored XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.
CVSS v3.1: 7.1
GHSA-9v3g-8955-wqqq: The Windows Printing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows local users to read arbitrary files via a crafted separator page, aka "Print Spooler Read File Vulnerability."
GHSA-v37v-42c5-gf78: ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'ref' parameter. Attackers can send GET requests to the watched_searches.php endpoint with crafted SQL payloads to extract sensitive database information including usernames and credentials.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
GHSA-47pm-99w9-6mx8: A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code Execution Vulnerability." This affects PowerShell Editor, PowerShell Extension.
CVSS v3.1: 9.8
GHSA-rgg3-3wh7-w935: Unrestricted Upload of File with Dangerous Type in Zenario CMS
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
CVSS v3.1: 9.8
GHSA-6cvq-37w5-gqjp: Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Planning. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Planning accessible data. CVSS 3.0 Base Score 4.2 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N).
CVE-2024-10217: TIBCO Hawk Stored-XSS Vulnerability
XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence
CVSS v4.0: 9.2
CVE-2015-6966: Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) create a post via a new_simple action to admin.php or (2) conduct cross-site scripting (XSS) attacks via the content parameter in a new_simple action to admin.php.
CVSS v2.0: 6.8
CVE-2025-27355: WordPress Woocommerce – Loi Hamon Plugin <= 1.1.0 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Nicolas GRILLET Woocommerce – Loi Hamon loi-hamon allows Stored XSS.This issue affects Woocommerce – Loi Hamon: from n/a through <= 1.1.0.
CVSS v3.1: 7.1
CVE-2022-24333: In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.
CVSS v3.1: 6.5
CVSS v2.0: 4