ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2004-1705: Buffer overflow in Citadel/UX 6.23 and earlier allows remote attackers to cause a denial of service via a long username.
CVSS v2.0: 5
GHSA-hqqf-rvh9-623q: Multiple cross-site scripting (XSS) vulnerabilities in AOM Software Beex 3 allow remote attackers to inject arbitrary web script or HTML via the navaction parameter to (1) news.php and (2) partneralle.php.
GHSA-rpq9-qv3x-7272: A vulnerability was found in ESAFENET CDG V5. It has been classified as problematic. This affects an unknown part of the file /todolistjump.jsp. The manipulation of the argument flowId leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
GHSA-7wmq-973g-rwg4: Cmder Console Emulator 1.3.18 contains a buffer overflow vulnerability that allows attackers to trigger a denial of service condition through a maliciously crafted .cmd file. Attackers can create a specially constructed .cmd file with repeated characters to overwhelm the console emulator's buffer and crash the application.
CVSS v4.0: 6.7
CVSS v3.1: 9.8
CVE-2025-36905: In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-gj8m-gcc5-r6h7: An information disclosure vulnerability in the MediaTek video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: N/A. Android ID: A-31249105.
CVSS v3.0: 5.5
GHSA-gqh4-5m73-25f6: Buffer overflow in vqSoft vqServer 1.4.49 allows remote attackers to cause a denial of service or possibly gain privileges via a long HTTP GET request.
GHSA-gw9m-2m5v-c6x5: usememos/memos Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1
CVSS v3.1: 4.3
GHSA-cfxg-rvg8-6h6c: An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated user to leverage parameter injection to overwrite arbitrary system files.
CVSS v3.1: 7.2
CVE-2026-5089: YAML::Syck versions before 1.38 for Perl has an out-of-bounds read
YAML::Syck versions before 1.38 for Perl  has an out-of-bounds read.

The base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:

    while ( colon >= ptr && *colon != ':' )
    {
        colon--;
    }
    if ( *colon == ':' ) *colon = '\0';  // colon may be ptr-1 here

When no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer.
CVSS v3.1: 7.3
CVE-2022-32253: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input validation, the OpenSSL certificate's password could be printed to a file reachable by an attacker.
CVSS v3.1: 4.9
RHSA-2022:9081: Red Hat Security Advisory: thunderbird security update
Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content Mozilla: Arbitrary file read from a compromised content process Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions Mozilla: Memory safety bugs fixed in Firefox ESR 102.6 and Thunderbird 102.6 Mozilla: Use-after-free in WebGL Mozilla: Memory corruption in WebGL Mozilla: Use-after-free in WebGL
CVSS v3.1: 8.1
CVE-2023-5192: Excessive Data Query Operations in a Large Data Table in pimcore/demo
Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.
CVSS v3.0: 6.1
GHSA-hq89-86g9-8p72: SMB Client and Server Remote Code Execution Vulnerability.
CVSS v3.1: 8.8
CVE-2020-28103: cscms v4.1 allows for SQL injection via the "page_del" function.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-38f5-ghc2-fcmv: Code Injection in cryo
All versions of `cryo` are vulnerable to code injection due to an Insecure implementation of deserialization.Proof of conceptRecommendationNo fix is currently available. Consider using an alternative module until a fix is made available.
CVSS v3.1: 9.8
GHSA-4qqf-vxv4-9698: Stack-based buffer overflow in the nestlex function in nestlex.c in Socat 1.5.0.0 through 1.7.1.2 and 2.0.0-b1 through 2.0.0-b3, when bidirectional data relay is enabled, allows context-dependent attackers to execute arbitrary code via long command-line arguments.
CVE-2015-8487: Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488.
CVSS v3.0: 4.3
CVSS v2.0: 2.6
GHSA-3h5p-hx2f-x27c: Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product.
CVSS v3.1: 7.5
CVE-2001-0932: Buffer overflow in Cooolsoft PowerFTP Server 2.03 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long command.
CVSS v2.0: 7.5
GHSA-x7rx-4g3v-3xr7: Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /dev/pts/ and /dev/tty*.
CVSS v3.1: 5.5
GHSA-x8rj-fvcp-g6j3: An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "Security" component. A buffer overflow allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS v3.0: 7.8
CVE-2024-50697: In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient bounds checks. This may result in a stack-based buffer overflow.
CVSS v3.1: 8.1
CVE-2025-8036: DNS rebinding circumvents CORS
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVSS v3.1: 8.1
CVE-2016-9421: Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
RHSA-2020:0594: Red Hat Security Advisory: curl security update
curl: HTTP authentication leak in redirects curl: FTP path trickery leads to NIL byte out of bounds write curl: LDAP NULL pointer dereference curl: RTSP RTP buffer over-read curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service
CVSS v3.0: 5.4
CVE-2018-0911: Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910, CVE-2018-0912, CVE-2018-0913, CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2024-53005: Substance3D - Modeler | Out-of-bounds Read (CWE-125)
Substance3D - Modeler versions 1.14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
CVE-2010-1464: Multiple cross-site scripting (XSS) vulnerabilities in WebAsyst Shop-Script FREE allow remote attackers to inject arbitrary web script or HTML via the (1) currency_id_left, (2) currency_id_right, (3) darkcolor, (4) lightcolor, (5) middlecolor, and (6) w parameters.
CVSS v2.0: 4.3
CVE-2001-0874: Internet Explorer 5.5 and 6.0 allow remote attackers to read certain files via HTML that passes information from a frame in the client's domain to a frame in the web site's domain, a variant of the "Frame Domain Verification" vulnerability.
CVSS v2.0: 5
GHSA-phq4-pr85-3v44: E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
CVE-2017-13311: In the read() function of ProcessStats.java, there is a possible read/write serialization issue leading to a permissions bypass. This could lead to local escalation of privilege where an app can start an activity with system privileges with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-ggx5-r43p-75wm: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing.
CVSS v3.0: 9.8
RHSA-2026:3957: Red Hat Security Advisory: Red Hat AMQ Broker 7.13.4 release and security update
org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
CVSS v3.1: 9.1
GHSA-qcc5-j37h-w6f4: Adobe Character Animator version 4.4 (and earlier versions) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 3.3
CVE-2010-2169: Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allow attackers to cause a denial of service (pointer memory corruption) or possibly execute arbitrary code via unspecified vectors.
CVSS v2.0: 9.3
GHSA-f84x-5jrq-4c3p: Heap-based buffer overflow in wiretap/dct3trace.c in Wireshark 1.2.0 through 1.2.14 and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long record in a Nokia DCT3 trace file.
CVE-2003-1006: Buffer overflow in cd9660.util in Apple Mac OS X 10.0 through 10.3.2 and Apple Mac OS X Server 10.0 through 10.3.2 may allow local users to execute arbitrary code via a long command line parameter.
CVSS v2.0: 7.2
CVE-2024-1002: Totolink N200RE cstecgi.cgi setIpPortFilterRules stack-based overflow
A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ePort leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 7.2
CVSS v3.0: 7.2
CVSS v2.0: 8.3
GHSA-mmmh-j7wc-66pp: Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim Line LOV).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.1: 7.5
CVE-2020-4951: IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive information.
CVSS v3.0: 4
GHSA-6xgg-q25c-fcr4: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8000014c.
CVSS v3.0: 7.8
CVE-2025-10087: SourceCodester Pet Grooming Management Software profit_report.php sql injection
A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/profit_report.php. Such manipulation of the argument product_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 4.7
CVSS v3.0: 4.7
CVSS v2.0: 5.8
ICSA-16-343-01: Moxa MiiNePort Session Hijack Vulnerabilities
An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files. An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. Configuration data are stored in a file that is not encrypted.
CVSS v3.0: 5.3
GHSA-8h93-38hx-vv92: Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
busy-loop.There is no other way for the application to escape or exit this loop other
than killing the thread/process.This might be used to DoS libcurl-using application.
CVSS v3.1: 7.5
GHSA-3m2x-p87c-pwv6: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.
CVSS v3.1: 7.8
GHSA-62rj-q587-5xq8: A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall (AIWAF) <= 4.1.6 and <=5.0 was identified on the subpage `/process_management/process_status.xhr.php`. This vulnerability allows an attacker to inject malicious scripts that execute in the context of the victim's session.
CVSS v3.1: 6.1
GHSA-g3qq-8w29-572m: The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.
CVSS v3.0: 6.5
CVE-2021-38119: Possible Reflected Cross-Site Scripting (XSS) Vulnerability in OpenText iManager
Possible Reflected Cross-Site Scripting (XSS) Vulnerability

in iManager has been discovered in
OpenText™ iManager 3.2.4.0000.
CVSS v3.1: 6.1
GHSA-gqx8-cxgc-96jv: The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.11 does not properly handle chunked transfer encoding during a call to response.sendRedirect, which allows remote attackers to cause a denial of service via a GET request.
PYSEC-2021-294: TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.SdcaOptimizerV2`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/sdca_internal.cc#L320-L353) does not check that the length of `example_labels` is the same as the number of examples. We have patched the issue in GitHub commit a4e138660270e7599793fa438cd7b2fc2ce215a6. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVE-2024-22441: HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass.
CVSS v3.1: 9.8
CVE-2015-2979: Webservice-DIC yoyaku_v41 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS v2.0: 7.5
GHSA-m39v-rgw3-qmpc: A vulnerability has been found in Craig Rodway Classroombookings up to 2.8.6 and classified as problematic. This vulnerability affects unknown code of the file /rooms/fields of the component Room Page. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.8.7 is able to address this issue. It is recommended to upgrade the affected component. The project maintainer was contacted early about the disclosure. He responded very quickly, friendly, and professional.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
GHSA-q6v3-r63x-q74w: Improper Resource Locking vulnerability in B&R Industrial Automation Automation Runtime.This issue affects Automation Runtime: from 6.0 before 6.3, before Q4.93.
CVSS v4.0: 9.3
CVSS v3.1: 10
GHSA-hmg7-4c9c-v6g9: serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a filename.
CVSS v3.0: 9.8
GHSA-5p2r-vgvp-m365: Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could allow an attacker to gain unauthorized access and in some cases escalate their level of privilege or execute arbitrary code.
CVSS v3.0: 9.8
CVE-2021-34503: Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVSS v3.1: 7.8
CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display
In the Linux kernel, the following vulnerability has been resolved:

drm/xe/display: fix oops in suspend/shutdown without display

The xe driver keeps track of whether to probe display, and whether
display hardware is there, using xe->info.probe_display. It gets set to
false if there's no display after intel_display_device_probe(). However,
the display may also be disabled via fuses, detected at a later time in
intel_display_device_info_runtime_init().

In this case, the xe driver does for_each_intel_crtc() on uninitialized
mode config in xe_display_flush_cleanup_work(), leading to a NULL
pointer dereference, and generally calls display code with display info
cleared.

Check for intel_display_device_present() after
intel_display_device_info_runtime_init(), and reset
xe->info.probe_display as necessary. Also do unset_display_features()
for completeness, although display runtime init has already done
that. This will need to be unified across all cases later.

Move intel_display_device_info_runtime_init() call slightly earlier,
similar to i915, to avoid a bunch of unnecessary setup for no display
cases.

Note #1: The xe driver has no business doing low level display plumbing
like for_each_intel_crtc() to begin with. It all needs to happen in
display code.

Note #2: The actual bug is present already in commit 44e694958b95
("drm/xe/display: Implement display support"), but the oops was likely
introduced later at commit ddf6492e0e50 ("drm/xe/display: Make display
suspend/resume work on discrete").

(cherry picked from commit 7c3eb9f47533220888a67266448185fd0775d4da)
CVE-2006-7125: Cross-site scripting (XSS) vulnerability in Joomla BSQ Sitestats 1.8.0 and 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled when the administrator views site statistics.
CVSS v2.0: 6.8
CVE-2005-4290: Cross-site scripting (XSS) vulnerability in index.cgi in ECW-Cart 2.03 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) kword, (2) max, (3) min, (4) comp, and (5) f parameters.
CVSS v2.0: 4.3
GHSA-xr8x-pxm6-prjg: MITM based Zip Slip in `org.hl7.fhir.publisher:org.hl7.fhir.publisher`
ImpactMITM can enable Zip-Slip.VulnerabilityVulnerability 1: `Publisher.java`There is no validation that the zip file being unpacked has entries that are not maliciously writing outside of the intended destination directory.https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java#L3598-L3610Vulnerability 2: `WebSourceProvider.java`There is a check for malicious zip entries here, but it is not covered by test cases and could potentially be reverted in future changes.https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/web/WebSourceProvider.java#L104-L112Vulnerability 3: `ZipFetcher.java`This retains the path for Zip files in FetchedFile entries, which could later be used to output malicious entries to another compressed file or file system.https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/ZipFetcher.java#L57-L106Vulnerability 4: `IGPack2NpmConvertor.java`The loadZip method retains the path for entries in the zip file, which could later be used to output malicious entries to another compressed file or file system.https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/IGPack2NpmConvertor.java#L442-L463
CVSS v3.1: 9.1
CVE-2024-30159: A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.
CVSS v3.1: 4.8
GHSA-fggm-9h4q-ppg4: In the Linux kernel before 4.14, an out of boundary access happened in drivers/nvme/target/fc.c.
CVSS v3.1: 9.8
GHSA-g6cr-75pq-47x7: Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command. This vulnerability could allow the compadmin user to elevate privileges. This only impacts Smartlock WORM compliance mode clusters as a critical vulnerability and Dell recommends to update/upgrade at the earliest opportunity.
CVE-2021-46047: A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_hinter_finalize function.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2025-43015: In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces
CVSS v3.1: 8.3
RHSA-2023:0607: Red Hat Security Advisory: thunderbird security update
Mozilla: Revocation status of S/Mime signature certificates was not checked
CVSS v3.1: 7.5
CVE-2008-2975: Cross-site scripting (XSS) vulnerability in admin/objects/obj_image.php in TinX/cms 1.1 allows remote attackers to inject arbitrary web script or HTML via the language parameter.
CVSS v2.0: 4.3