ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-w995-ff8h-rppg: OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
SummaryA SQL Injection vulnerability exists in the `ajax_complete.php` endpoint when handling the `get_sedi` operation. An authenticated attacker can inject malicious SQL code through the `idanagrafica` parameter, leading to unauthorized database access.Proof of ConceptVulnerable Code**File:** `modules/anagrafiche/ajax/complete.php:28`Data Flow**Source:** `$_GET['idanagrafica']` → `get('idanagrafica')`**Vulnerable:** User input concatenated directly into SQL query with single quotes**Sink:** `$dbo->fetchArray($q)` executes the malicious queryExploit**Manual PoC (Time-based Blind SQLi):****SQLMap Exploitation:****SQLMap Output:**Impact**Data Exfiltration:** Complete database extraction including user credentials, customer data, financial records**Privilege Escalation:** Modification of `zz_users` table to gain admin access**Data Integrity:** Unauthorized modification or deletion of records**Potential RCE:** Via `SELECT ... INTO OUTFILE` if file permissions allowAffected VersionsOpenSTAManager: Verified in latest version (as of December 2025)All versions using this endpoint are likely affectedRemediationReplace direct concatenation with prepared statements:**Before:****After:**CreditDiscovered by: Łukasz Rybak
CVSS v4.0: 8.7
CVE-2024-43249: WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.This issue affects Bit Form Pro: from n/a through 2.6.4.
CVSS v3.1: 9.9
GHSA-6gr4-mx2p-46wq: SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doesnt use adequate measures to protect encryption keys in transit which allows unauthenticated physically proximate attacker to sniff keys via (BLE).
GHSA-qpwc-4vhw-6x7f: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to determine kernel memory layout.
CVSS v3.1: 5.5
CVE-2019-25266: Wondershare Application Framework Service 2.4.3.231 - 'WsAppService' Unquote Service Path
Wondershare Application Framework Service 2.4.3.231 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted service path by placing malicious executables in specific directory locations to hijack the service's execution context.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
CVE-2024-44683: Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php.
CVSS v3.1: 6.1
GHSA-3j48-6389-rp2g: IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
CVSS v3.0: 8.8
GHSA-cc7j-j6fh-4xhc: Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms (on Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
GHSA-3m8h-rcx6-p525: In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 3.3
GHSA-h5f3-pcvq-73ww: A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/products/manage_product.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-225530 is the identifier assigned to this vulnerability.
CVSS v3.1: 9.8
GHSA-h7r4-jcmg-97wh: Cisco Emergency Responder 10.5(3.10000.9) allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501.
GHSA-jff7-h8x2-v2hj: The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (crash) in ESP32 by flooding the target device with LMP Feature Response data.
CVSS v3.1: 6.5
CVE-2026-1852: Product Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion
The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the updateLabel() and remove() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages or delete pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-rccw-f2p8-cj94: Cisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which allows remote attackers to modify settings or perform unspecified other administrative actions via unknown vectors, aka Bug ID CSCts59135.
GHSA-6p3r-79mc-w88g: Unspecified vulnerability in the HotSpot Server component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
GHSA-9fp7-fqq2-57mv: Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a ..  (dot dot) in the localeset parameter in setup.php.  NOTE: the vendor states that this issue might exist due to problems in third party local files.
CVE-2017-6763: A vulnerability in the implementation of the H.264 protocol in Cisco Meeting Server (CMS) 2.1.4 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability exists because the affected application does not properly validate Fragmentation Unit (FU-A) protocol packets. An attacker could exploit this vulnerability by sending a crafted H.264 FU-A packet through the affected application. A successful exploit could allow the attacker to cause a DoS condition on the affected system due to an unexpected restart of the CMS media process on the system. Although the CMS platform continues to operate and only the single, affected CMS media process is restarted, a brief interruption of media traffic for certain users could occur. Cisco Bug IDs: CSCve10131.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2018-11720: Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow Directory Traversal.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-q6qg-c79q-f6q2: The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.8
CVE-2024-36059: Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer protocol.
CVSS v3.1: 9.4
GHSA-q96g-cqh9-7qfc: The print_exprloc_content function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CVSS v3.1: 6.5
GHSA-4c75-wgq4-xcm6: Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.
CVSS v3.0: 6.5
CVE-2008-0016: Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a crafted UTF-8 URL in a link.
CVSS v2.0: 10
GHSA-cxh4-rfq4-vxw5: Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4176.
CVSS v3.0: 9.8
cisco-sa-20190925-iosxe-fsdos: Cisco IOS XE Software Filesystem Exhaustion Denial of Service Vulnerability
A vulnerability in the filesystem resource management code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to exhaust filesystem resources on an affected device and cause a denial of service (DoS) condition.

The vulnerability is due to ineffective management of the underlying filesystem resources. An attacker could exploit this vulnerability by performing specific actions that result in messages being sent to specific operating system log files. A successful exploit could allow the attacker to exhaust available filesystem space on an affected device. This could cause the device to crash and reload, resulting in a DoS condition for clients whose network traffic is transiting the device. Upon reload of the device, the impacted filesystem space is cleared, and the device will return to normal operation. However, continued exploitation of this vulnerability could cause subsequent forced crashes and reloads, which could lead to an extended  DoS condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-fsdos ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-fsdos"]

This advisory is part of the September 25, 2019, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2019 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-72547"].
CVSS v3.0: 8.6
CVE-2006-3057: Unspecified vulnerability in NetworkManager daemon for DHCP (dhcdbd) allows remote attackers to cause a denial of service (crash) via certain invalid DHCP responses that trigger memory corruption.
CVSS v2.0: 5
GHSA-j5q7-9p99-x3r2: iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getstring's return.
CVSS v3.1: 5.5
GHSA-cw9m-pj72-3cj5: A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
GHSA-8jgq-q52v-cx7m: Out-of-bounds read in firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclosure via network access.
CVSS v4.0: 5.9
CVSS v3.1: 4.4
GHSA-q38f-rrwp-2h7x: HPE has identified a cross site scripting (XSS) vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.
CVSS v3.0: 5.4
RHSA-2024:8425: Red Hat Security Advisory: OpenShift Container Platform 4.15.37 bug fix and security update
golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients containers/image: digest type does not guarantee valid type net/http: Denial of service due to improper 100-continue handling in net/http cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials jose-go: improper handling of highly compressed data go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion
CVSS v3.1: 5.9
CVE-2015-1064: Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
CVSS v2.0: 1.9
GHSA-gm6c-gr8h-r4hg: Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
CVSS v3.1: 7.8
GHSA-gmc4-5rff-2xrj: Out of bounds read in Media in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 8.8
CVE-2022-30262: The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.
CVSS v3.1: 7.8
CVE-2021-1821: A logic issue was addressed with improved state management. This issue is fixed in watchOS 7.6, macOS Big Sur 11.5. Visiting a maliciously crafted webpage may lead to a system denial of service.
CVSS v3.1: 6.5
CVSS v2.0: 7.1
CVE-2018-7990: Mate10 Pro Huawei smart phones with the versions before 8.1.0.326(C00) have a FRP bypass vulnerability. During the mobile phone reseting process, an attacker could bypass "Find My Phone" protect after a series of voice and keyboard operations. Successful exploit could allow an attacker to bypass FRP.
CVSS v3.0: 4.6
CVSS v2.0: 4.9
GHSA-3rph-74jp-p9fc: A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion on a vulnerable system.
CVSS v3.0: 8.1
GHSA-57r8-4369-33xg: The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged application  access to read system files that are accessible to the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.16 and below.
CVSS v3.1: 7.7
CVE-2005-3558: PHP file inclusion vulnerability in index.php in OSTE 1.0 allows remote attackers to execute arbitrary code via the (1) page and (2) site parameters.
CVSS v2.0: 7.5
GHSA-mm78-fgq8-6pgr: StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
SummaryThe S3 storage manager's `isAuthorized()` function is declared `async` (returns `Promise<boolean>`) but is called without `await` in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, `!isAuthorized(type)` always evaluates to `false`, completely bypassing the authorization check. Any authenticated user with the lowest `visitor` role can upload, delete, rename, and list all files in the S3 bucket.DetailsThe `isAuthorized` function is typed as returning `Promise<boolean>` in `packages/studiocms/src/handlers/storage-manager/definitions.ts:88`:Both context drivers implement it as `async` — `packages/studiocms/src/handlers/storage-manager/core/effectify-astro-context.ts:32`:But in the S3 storage manager, it's called without `await` — `packages/@studiocms/s3-storage/src/s3-storage-manager.ts:200`:And again at line 372 (PUT handler):`isAuthorized(type)` returns a `Promise` object. `!Promise{...}` is always `false` because a Promise is truthy. The 401 response is never returned.**Execution flow:**Visitor-role user sends POST to `/studiocms_api/integrations/storage/manager``AstroLocalsMiddleware` verifies session exists — passes (visitor is logged in)Handler calls `!isAuthorized('locals')` → evaluates `!Promise{...}` = `false`Authorization check is skipped entirelyVisitor performs the requested storage operationPoCImpactAny authenticated visitor gains full S3 storage management (upload, delete, rename, list) — capabilities restricted to editor role and aboveAttacker can delete arbitrary files from the S3 bucket, causing data lossAttacker can list all files and generate presigned download URLs, exposing all stored contentAttacker can upload arbitrary files or rename existing ones, replacing legitimate content with malicious payloadsRecommended FixAdd `await` to both `isAuthorized()` calls in `packages/@studiocms/s3-storage/src/s3-storage-manager.ts`:
CVSS v3.1: 7.6
CVE-2000-0978: bbd server in Big Brother System and Network Monitor before 1.5c2 allows remote attackers to execute arbitrary commands via the "&" shell metacharacter.
CVSS v2.0: 7.5
GHSA-jwc5-fc4v-xgw5: Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products (subcomponent: Web Runtime). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.0: 6.1
RHSA-2020:0952: Red Hat Security Advisory: Red Hat Single Sign-On 7.3.7 security update
undertow: AJP File Read/Inclusion Vulnerability
CVSS v3.1: 7.6
CVE-2026-41250: XSS in taiga-front
Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Taiga front is vulnerable to stored XSS. This vulnerability is fixed in 6.9.1.
CVSS v3.1: 5.7
GHSA-xqm3-prp6-x5jx: Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote attackers to inject arbitrary web script or HTML via a crafted password.
GHSA-3c2g-fm84-g225: The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in portlets with the default resource serving for GenericPortlet, does not properly restrict access to restricted resources, which allows remote attackers to obtain sensitive information via a URL with a modified resource ID.
GHSA-2gp6-hhcq-r4r4: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-34714, CVE-2022-35745, CVE-2022-35752, CVE-2022-35753, CVE-2022-35766, CVE-2022-35767, CVE-2022-35794.
CVSS v3.1: 8.1
GHSA-3r35-352r-wrcc: LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
CVSS v3.1: 5.5
GHSA-44wr-rmwq-3phw: Craft CMS vulnerable to Remote Code Execution via validatePath bypass
SummaryBypassing the validatePath function can lead to potential Remote Code Execution
(Post-authentication, ALLOW_ADMIN_CHANGES=true)DetailsIn bootstrap.php, the SystemPaths path is set as below.Because paths are validated based on the /path1/path2 format, this can be bypassed using a file URI scheme such as file:///path1/path2. File scheme is supported in mkdir()ref. https://www.php.net/manual/en/wrappers.file.phpPoCCreate a new filesystem. **Base Path: file:///var/www/html/templates**![1](https://user-images.githubusercontent.com/30969523/249252853-5cde9bae-9279-428a-972b-d4444c545819.png)Create a new asset volume. Asset Filesystem: local_bypass![2](https://user-images.githubusercontent.com/30969523/249256711-e37da7f8-52d6-4ecc-bfc4-b9b9d8a2230d.png)Upload a ttml file with rce template code. Confirm poc.ttml file created in /var/www/html/templates![3](https://user-images.githubusercontent.com/30969523/249256731-8dafc3dc-4937-4f69-bba0-97bc96be1ada.png)
![4](https://user-images.githubusercontent.com/30969523/249257369-54e22aff-3919-4a21-b696-a7be74086ff9.png)Create a new route. URI: * , Template: poc.ttml![5](https://user-images.githubusercontent.com/30969523/249257437-972ec725-8197-4472-9b57-750ab91d9bfd.png)Confirm RCE on arbitrary path ( /* )![6](https://user-images.githubusercontent.com/30969523/249257465-061dbaf8-a2c6-4366-80f5-986a15bad748.png)PoC Env![0628 env](https://user-images.githubusercontent.com/30969523/249252784-6e5913ad-9ad1-4d3a-a70f-2c5ff9f55166.png)ImpactTake control of vulnerable systems, Data exfiltrations, Malware execution, Pivoting, etc.although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution)
CVSS v3.1: 7.2
GHSA-62pq-5f48-mpmh: An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63526567.
CVSS v3.0: 5.5
CVE-2022-26498: An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-chw4-88xc-79w6: Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.
CVSS v3.1: 9.8
CVE-2005-4643: SQL injection vulnerability in index.php in Antharia OnContent // CMS allows remote attackers to execute arbitrary SQL commands via the pid parameter.  NOTE: it is not clear, but this might be an application service provider, in which case it might be excluded from CVE.
CVSS v2.0: 7.5
RHSA-2025:4008: Red Hat Security Advisory: OpenShift Container Platform 4.16.39 bug fix and security update
baremetal-operator/apis: Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
CVSS v3.1: 7.5
GHSA-622c-3525-jxfp: Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service (CPU consumption and search outage) via crafted LDAP search requests with patterns, related to a single-threaded regular-expression subsystem.
CVE-2024-51810: WordPress Lewe Bootstrap Visuals plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in George Lewe Lewe Bootstrap Visuals shortcode-bootstrap-visuals allows Stored XSS.This issue affects Lewe Bootstrap Visuals: from n/a through <= 3.0.1.
CVSS v3.1: 6.5