ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2013-2079: mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download (aka downloadall) requests, which allows remote authenticated users to read other users' assignments by leveraging the student role.
CVSS v2.0: 4
GHSA-2g2x-6p8h-94w3: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.4.37651. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Document objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13741.
GHSA-8p3j-jhwf-33v9: Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot.
CVSS v3.0: 8
CVE-2018-2921: Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: User Interface). The supported version that is affected is Prior to 8.7.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance Kit (AK). While the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Sun ZFS Storage Appliance Kit (AK) accessible data. CVSS 3.0 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
CVSS v3.0: 5.8
CVSS v2.0: 5
GHSA-g4m7-45vg-g8rv: The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 7.2
GHSA-cw3g-vfwg-6jp9: CSRF exists in BigTree CMS 4.1.18 with the nav-social[#] parameter to the admin/settings/update/ page. The Navigation Social can be changed.
CVSS v3.0: 4.3
PYSEC-2026-393: The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_load is not used for YAML.
CVSS v3.1: 9.8
GHSA-rmpr-6w5x-hf6g: In the Linux kernel, the following vulnerability has been resolved:f2fs: check validation of fault attrs in f2fs_build_fault_attr()It missed to check validation of fault attrs in parse_options(),
let's fix to add check condition in f2fs_build_fault_attr().Use f2fs_build_fault_attr() in __sbi_store() to clean up code.
CVSS v3.1: 7.8
CVE-2026-25469: WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability
Missing Authorization vulnerability in ViaBill for WooCommerce ViaBill – WooCommerce viabill-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ViaBill – WooCommerce: from n/a through <= 1.1.53.
CVSS v3.1: 6.5
ICSA-23-103-03: Siemens in OPC Foundation Local Discovery Server
OPC Foundation Local Discovery Server (LDS) in affected products uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is loaded by LDS (running as a high-privilege user).
CVSS v3.1: 7.8
GHSA-qw99-59fj-mwq3: Multiple cross-site scripting (XSS) vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) account.php, (2) moresmiles.php, or (3) recover.php; or (4) the "to" parameter to usercp.php.
CVE-2021-36712: Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function.
CVSS v3.1: 5.4
CVE-2021-34617: A remote cross-site scripting (XSS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.13 and below; Aruba Instant 6.5.x: 6.5.4.13 and below; Aruba Instant 8.3.x: 8.3.0.7 and below; Aruba Instant 8.4.x: 8.4.0.5 and below; Aruba Instant 8.5.x: 8.5.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-x3h8-62x9-952g: Astro Development Server has Arbitrary Local File Read
SummaryA vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system.Details**Title**: Arbitrary Local File Read in Astro Development Image Endpoint**Type**: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')**Component**: `/packages/astro/src/assets/endpoint/node.ts`**Affected Versions**: Astro v5.x development builds (confirmed v5.13.3)**Attack Vector**: Network (HTTP GET request)**Authentication Required**: NoneThe vulnerability exists in the Node.js image endpoint handler used during development mode. The endpoint accepts an `href` parameter that specifies the path to an image file. In development mode, this parameter is processed without adequate path validation, allowing attackers to specify absolute file paths.**Vulnerable Code Location**: `packages/astro/src/assets/endpoint/node.ts`The development branch bypasses the security checks that exist in the production code path, which validates that file paths are within the allowed assets directory.PoCAttack PrerequisitesAstro development server must be running (`astro dev`)The `/_image` endpoint must be accessible to the attackerTarget image files must be readable by the Node.js processExploit StepsStart Astro Development Server:Craft Malicious Request:Example Attack:Demonstration Results**Test Environment**: macOS with Astro v5.13.3**Successful Exploitation**:Target: `/System/Library/Image Capture/Automatic Tasks/MakePDF.app/Contents/Resources/0blank.jpg`Response: HTTP 200 OK, Content-Type: image/pngExfiltration: 303 bytes (100x100 PNG)File Created: `stolen-image.png` containing processed system image**Attack Payload**:**Server Response**:ImpactConfidentiality Impact: HIGH**Scope**: Any image file readable by the Node.js process**Exfiltration Method**: Complete file contents via HTTP response (transformed to PNG)Integrity Impact: NONEThe vulnerability only allows reading files, not modificationAvailability Impact: NONENo direct impact on system availabilityPotential for resource exhaustion through repeated large image requestsAffected ComponentsPrimary Component**File**: `packages/astro/src/assets/endpoint/node.ts`**Function**: `loadLocalImage()`**Lines**: Development mode branch (~25-35)Secondary Components**File**: `packages/astro/src/assets/endpoint/generic.ts`**Impact**: Uses different code path, not directly vulnerable**Note**: Implements proper remote allowlist validation
CVSS v3.1: 3.5
GHSA-chxv-752j-4vj4: Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges via the Export System Info function in MSI.CentralServer.exe
CVSS v3.1: 6.8
CVE-2025-36057: IBM Cognos Analytics Mobile (iOS) authentication bypass
IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 

is vulnerable to authentication bypass by using the Local Authentication Framework library which is not needed as biometric authentication is not used in the application.
CVSS v3.1: 5.2
CVE-2012-0633: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVSS v2.0: 9.3
GHSA-ppx5-75jp-426p: On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter.
CVSS v3.0: 8.1
GHSA-25w4-53f5-6rmr: Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 7.3
CVE-2025-51628: Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthenticated attackers to read confidential documents via the DocumentoId parameter.
CVSS v3.1: 7.5
CVE-2021-3007: Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-g3gf-qxvh-gpx4: HP OpenVMS 8.3, 8.3-1H1, and 8.4 on the Itanium platform and 7.3-2, 8.2, 8.3, and 8.4 on the Alpha platform does not properly implement the LOGIN and ACME_SERVER ACMELOGIN programs, which allows local users to cause a denial of service via unspecified vectors.
GHSA-62jj-gr2r-5c34: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
CVSS v3.1: 6.8
ICSA-23-278-01: Hitachi Energy AFS65x,AFF66x, AFS67x, and AFR67x Series Products
In Expat (aka libexpat) before 2.4.3, a left shift by 29(or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. Vulnerable code using addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Vulnerable code using build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow Vulnerable code using defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. The lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Vulnerable code using nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string. In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames Vulnerable code in xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. Vulnerable code in xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
CVSS v3.0: 7.5
GHSA-9hww-pc44-6fgh: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
GHSA-mrhj-2g4v-39qx: Moderate severity vulnerability that affects rails-html-sanitizer
Withdrawn, accidental duplicate publish.Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
GHSA-4j78-c8h2-ff3f: libexif 0.6.16 and earlier allows context-dependent attackers to cause a denial of service (infinite recursion) via an image file with crafted EXIF tags, possibly involving the exif_loader_write function in exif_loader.c.
GHSA-v9xx-74wg-qf63: Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors.
CVE-2026-44444: Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships a package.json with a preinstall, postinstall, or prepare lifecycle script achieves host-level code execution the moment an admin presses Install before any dist file is inspected. This vulnerability is fixed in 0.9.7.
CVSS v3.1: 9.1
CVE-2014-5198: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.3 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.
CVSS v2.0: 4.3
GHSA-349p-7f27-qvx8: AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-jc4g-746q-772h: A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web-based Configuration Interface. The manipulation of the argument rootAPmac leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Edimax confirms this issue: "The product mentioned, EDIMAX BR-6208AC V2, has reached its End of Life (EOL) status. It is no longer supported or maintained by Edimax, and it is no longer available for purchase in the market. Consequently, there will be no further firmware updates or patches for this device. We recommend users upgrade to newer models for better security." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
CVE-2019-0612: A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass vulnerability does not allow arbitrary code execution, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.
CVSS v3.0: 5.3
CVSS v2.0: 2.6
GHSA-36c4-85vg-5q9w: A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unknown functionality of the file /timetable/staff/staffdashboard.php?info=updateprofile. The manipulation of the argument n leads to sql injection. The attack can be launched remotely.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2024-36250: MFA Code Replay
Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds
CVSS v3.1: 3.1
GHSA-4xfj-vf8f-vwpp: An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7.
CVSS v3.0: 7.3
GHSA-6xv4-9cqp-92rh: messageformat prototype pollution vulnerability
The Runtime components of messageformat package for Node.js version 3.0.1 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle. Version 3.0.2 contains a fix.
CVSS v3.1: 5.3
GHSA-68rg-v3m3-f4hp: The AXIS Camera Station Server had a flaw that allowed
to bypass authentication that is normally required.
CVSS v4.0: 5.3
CVSS v3.1: 9.8
CVE-2022-26591: FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
GHSA-xcwp-4r9f-392x: Web Server in Apple OS X Server before 5.1 supports the RC4 algorithm, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
CVSS v3.0: 7.5
CVE-2007-3670: Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe.  NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data."
CVSS v2.0: 4.3
GHSA-f2vq-4xwg-pv9r: Dell Hybrid Client below 1.8 version contains a gedit vulnerability. A guest attacker could potentially exploit this vulnerability, allowing deletion of user and some system files and folders.
CVSS v3.1: 8.2
CVE-2007-0970: Multiple SQL injection vulnerabilities in WebTester 5.0.20060927 and earlier allow remote attackers to execute arbitrary SQL commands via the testID parameter to directions.php, and unspecified parameters to other files that accept GET or POST input.
CVSS v2.0: 7.5
GHSA-hg4w-h686-f7p2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ComMotion Course Booking System allows Reflected XSS. This issue affects Course Booking System: from n/a through 6.0.7.
CVSS v3.1: 7.1
CVE-2018-14797: Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
CVE-2024-54253: WordPress Xpro Addons For Elementor plugin <= 1.4.6.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.6.5.
CVSS v3.1: 6.5
CVE-2018-1835: IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150514.
CVSS v3.0: 7.1
GHSA-3vv5-prrw-675q: COMPAREX Miss Marple Enterprise Edition before 2.0 allows local users to execute arbitrary code by reading the user name and encrypted password hard-coded in an Inventory Agent configuration file.
CVSS v3.0: 7.8
CVE-2023-34387: WordPress Constant Contact Forms plugin <= 2.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Constant Contact Constant Contact Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact Forms: from n/a through 2.0.3.
CVSS v3.1: 4.3
CVE-2025-27460: CVE-2025-27460
The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumventing the Windows login. The attacker can read from and write to all files on the hard drives.
CVSS v3.1: 7.6
RHSA-2015:2579: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.0 commons-collections security update
apache-commons-collections: InvokerTransformer code execution during deserialisation
CVE-2023-23077: Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
CVSS v3.1: 6.1
CVE-2018-1152: libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
CVE-2024-8619: Ajax Search Lite <= 4.12.2 - Admin+ Stored XSS
The Ajax Search Lite  WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.8
CVE-2024-57086: A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS v3.1: 7.5
RHSA-2019:2110: Red Hat Security Advisory: rsyslog security and bug fix update
rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled
CVSS v3.0: 5.3
GHSA-2ph6-gc2m-75x2: Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, and Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) has unspecified impact and attack vectors, as identified by Oracle Vuln# DBC01 in the Protocol Support component.
CVE-2023-3543: GZ Scripts Availability Booking Calendar PHP HTTP POST Request load.php cross site scripting
A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file load.php of the component HTTP POST Request Handler. The manipulation of the argument cid/first_name/second_name/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233295. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-w496-m2v7-59g2: SQL injection vulnerability in asearch.php in webSPELL 4.2.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.