ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2017-2686: Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated user to read arbitrary files through the web interface at port 10000/TCP and access sensitive information.
CVSS v3.0: 6.5
CVSS v2.0: 4
CVE-2017-12537: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.
CVSS v3.0: 8.8
CVSS v2.0: 9
GHSA-qxc5-6f67-jc5c: SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header.
GHSA-v7f2-qghm-mg3r: A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. This affects an unknown function of the file /add-category-function.php. Such manipulation of the argument Category leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-g2r4-xgw7-33cp: Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text.
CVSS v3.1: 6.5
CVE-2022-33321: Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products (PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric HEMS Energy Measurement Unit, Refrigerator, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch, Ventilating Fan, Range hood fan, Energy Measurement Unit and Air Purifier) allows a remote unauthenticated attacker to disclose information in the products or cause a denial of service (DoS) condition as a result by sniffing credential information (username and password).
The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability.
As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.


CVSS v3.1: 9.8
CVE-2025-30556: WordPress  Fix Rss Feeds plugin <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds fix-rss-feed allows Cross Site Request Forgery.This issue affects Fix Rss Feeds: from n/a through <= 3.1.
CVSS v3.1: 4.3
CVE-2021-42683: A Buffer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200. The IOCTL Handler 0x22001B allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVSS v3.1: 8.8
CVSS v2.0: 7.2
RHSA-2020:4005: Red Hat Security Advisory: libxslt security update
libxslt: xsltCheckRead and xsltCheckWrite routines security bypass by crafted URL libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure
CVSS v3.1: 7.5
CVSS v3.0: 6.3
GHSA-vwmr-4hph-3f4r: A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 2
CVSS v3.1: 4.7
CVE-2016-2814: Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-fw58-q5m2-3fgm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through <= 1.7.6.
CVSS v3.1: 6.5
GHSA-m9qq-9wq4-v4hp: Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Others). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupport accessible data as well as unauthorized update, insert or delete access to some of Oracle iSupport accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVSS v3.0: 8.2
GHSA-mxfp-fxv6-wm97: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2004-2316: Mbedthis AppWeb HTTP server before 1.0.2 allows remote attackers to cause a denial of service (crash) via a GET request containing an MS-DOS device name such as COM1.
CVSS v2.0: 5
GHSA-28pw-f2p6-x4fr: Multiple SQL injection vulnerabilities in Voice Of Web AllMyGuests 0.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) allmyphp_cookie cookie to admin.php or the (2) Username or (3) Password.
CVE-2025-70247: Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizard1.
CVSS v3.1: 7.5
CVE-2015-2761: Cross-site scripting (XSS) vulnerability in the Exceptions and Scanning Exceptions Pages in Websense TRITON AP-WEB before 8.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
CVE-2007-4038: Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670.
CVSS v2.0: 4.3
GHSA-4wj2-pjwh-6xwv: SQL injection vulnerability in galerie.php in Galerie 3.2 allows remote attackers to execute arbitrary SQL commands via the pic parameter.
GHSA-x245-wv5c-hr8q: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed functionality. This makes it possible for authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to modify information from internal services. NOTE: This vulnerability, exploitable by contributor-level users, was was fixed in version 4.4.7. The same vulnerability was fixed for author-level users in version 4.4.8.
CVSS v3.1: 6.4
GHSA-4m5c-vffp-6p57: For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x10000e9 where a value is passed from an user to the driver is used without validation as the size input to memcpy() causing a stack buffer overflow, leading to denial of service or potential escalation of privileges.
CVSS v3.0: 7.8
CVE-2021-38560: Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2022-34366: 

Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information.






CVSS v3.1: 6.5
GHSA-xrc4-737v-9q75: OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals
ImpactThis issue concerns instances of Governor that use the module `GovernorVotesQuorumFraction`, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirement, past proposals may become executable if they had been defeated only due to lack of quorum, and the number of votes it received meets the new quorum requirement.Analysis of instances on chain found only one proposal that met this condition, and we are actively monitoring for new occurrences of this particular issue.PatchesThis issue has been patched in v4.7.2.WorkaroundsAvoid lowering quorum requirements if a past proposal was defeated for lack of quorum.Referenceshttps://github.com/OpenZeppelin/openzeppelin-contracts/pull/3561For more informationIf you have any questions or comments about this advisory, or need assistance deploying the fix, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).
CVSS v3.1: 7.5
CVE-2017-9076: The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2023-24795: Command execution vulnerability was discovered in JHR-N916R router firmware version<=21.11.1.1483.
CVSS v3.1: 9.8
GHSA-p2qg-cv6r-5429: gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c.
CVSS v3.1: 9.8
ICSA-17-187-01: Siemens OZW672 and OZW772
An attacker with access to Port 21/TCP could access or alter historical measurement data stored on the device.CVE-2017-6872 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). A vulnerability in the integrated web server on Port 443/TCP could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle (MITM) attack.CVE-2017-6873 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.0: 7.4
CVE-2026-58292: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVSS v3.1: 7.5
RHSA-2013:0237: Red Hat Security Advisory: java-1.7.0-oracle security update
JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Scripting) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (JMX) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) OpenJDK: RMI CGIHandler XSS issue (RMI, 6563318) OpenJDK: logging insufficient access control checks (Libraries, 6664509) OpenJDK: logging insufficient access control checks (Libraries, 6664528) OpenJDK: invalid threads subject to interrupts (Libraries, 6776941) OpenJDK: reflection API incorrect checks for proxy classes (Libraries, 7197546, SE-2012-01 Issue 29) OpenJDK: PresentationManager incorrectly shared (CORBA, 7141694) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Install) OpenJDK: JMX Introspector missing package access check (JMX, 8000539, SE-2012-01 Issue 52) OpenJDK: insufficient clipboard access premission checks (AWT, 7186952) OpenJDK: InetSocketAddress serialization issue (Networking, 7201071) OpenJDK: loadPropertyFile missing restrictions (JAXP, 8001235) OpenJDK: com.sun.xml.internal.* not restricted packages (JAX-WS, 7201068) JDK: unspecified vulnerability fixed in 7u13 (2D) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) OpenJDK: CPU consumption DoS via repeated SSL ClientHello packets (JSSE, 7192393) OpenJDK: missing serialization restriction (CORBA, 7201066) OpenJDK: insufficient privilege checking issue (AWT, 7192977) OpenJDK: insufficient Diffie-Hellman public key checks (JSSE, 7192392) OpenJDK: MethodFinder insufficient checks for cached results (Beans, 7200493) OpenJDK: insufficient privilege checking issue (AWT, 8001057) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) JDK: unspecified vulnerability fixed in 7u13 (Libraries) JDK: unspecified vulnerability fixed in 7u13 (Deployment) OpenJDK: RequiredModelMBean missing access control context checks (JMX, 8000537) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) OpenJDK: IIOP type reuse sandbox bypass (CORBA, 8000540, SE-2012-01 Issue 50) OpenJDK: missing ValueHandlerImpl class constructor access restriction (CORBA, 8000631) OpenJDK: image parser insufficient raster parameter checks (2D, 8001972) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (JavaFX) OpenJDK: image parser insufficient raster parameter checks (AWT, 8002325) 7: bypass of the security level setting in browser plugin (Deployment, SE-2012-01 Issue 53)
CVE-2014-1724: Use-after-free vulnerability in Free(b)soft Laboratory Speech Dispatcher 0.7.1, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service (application hang) or possibly have unspecified other impact via a text-to-speech request.
CVSS v2.0: 7.5
CVE-2020-7247: smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-98cj-v6w2-849r: In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-185126149
CVSS v3.1: 5.5
GHSA-xq4x-622m-q8fq: LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution
SummaryThe vulnerability was automatically discovered by an ai agent and then manually verified.LobeChat's message rendering mechanism has a stored cross-site scripting (XSS) vulnerability. Combined with the Electron main process's exposed insecure IPC interface, attackers can construct malicious payloads to achieve an attack chain from XSS to remote code execution (RCE).The LobeChat team verified this vulnerability in lobehub v2.1.23, and it also exists in the latest version.DetailsWhen LobeChat processes custom tags in the Render process of `src/features/Portal/Artifacts/Body/Renderer/index.tsx`, if no type match is found, it will choose to call the default method, HTMLRenderer, for HTML rendering.If an attacker can induce the LLM to output content containing malicious tags, an XSS vulnerability can be created on the client side.Additionally, Lobechat's Electron main process exposes an IPC interface called `runCommand`, used to invoke system commands. This interface allows arbitrary command execution and does not filter the `command` parameter. Therefore, if an attacker can obtain a handle to `window.parent.electronAPI` via XSS and call the `runCommand` method of the IPC, the `ipcMain` process can execute arbitrary system commands with the current user's privileges.PoCThe attacker launched a malicious OpenAI gateway on port 5001The victim opens the LobeChat application and configures an LLM Provider, entering the address of the HTTP server provided by the attacker.The victim was exposed to an arbitrary command execution vulnerability while chattingreproductionFor attack reproduction, refer to this video. Once the victim configures the attacker's LLM provider endpoint, arbitrary commands can be executed. Here, our demonstration `opens a calculator` in the victim's environment.https://github.com/user-attachments/assets/6383e996-9148-4e88-8e25-90260104368dImpactAffected LobeChat clients can connect to the attacker's LLM endpoint and trigger arbitrary command execution simply by sending normal conversation messages.PatchA patch is available at https://github.com/lobehub/lobehub/releases/tag/v2.1.48.
CVSS v3.1: 6.2
GHSA-2gc9-pwg3-hg5r: The afs_linux_lock function in afs/LINUX/osi_vnodeops.c in the kernel module in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions does not properly handle errors, which allows attackers to cause a denial of service via unknown vectors.  NOTE: some of these details are obtained from third party information.
CVE-2025-21410: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2019-14682: The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
CVSS v3.0: 4.3
CVSS v2.0: 4.3
GHSA-2j9g-whc6-7j55: UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.
CVSS v3.1: 7.5
GHSA-p8pq-r894-fm8f: XStream is vulnerable to an Arbitrary Code Execution attack
ImpactThe vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.PatchesXStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.WorkaroundsSee [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.ReferencesSee full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39146](https://x-stream.github.io/CVE-2021-39146.html).CreditsCeclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.For more informationIf you have any questions or comments about this advisory:Open an issue in [XStream](https://github.com/x-stream/xstream/issues)Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
CVSS v3.1: 8.5
ICSA-25-135-13: Siemens SIRIUS
Affected devices only provide weak password obfuscation. An attacker with network access could retrieve and de-obfuscate the safety password used for protection against inadvertent operating errors. The affected devices do not encrypt data in transit. An attacker with network access could eavesdrop the connection and retrieve sensitive information, including obfuscated safety passwords. The affected devices do not require authentication to access critical resources. An attacker with network access could retrieve sensitive information from certain data records, including obfuscated safety passwords.
CVSS v3.1: 5.9
CVE-2020-26409: A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassing input validation in markdown fields.
CVSS v3.1: 4.3
GHSA-54x5-pq33-x5xw: In MPEG4Extractor, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution in the media extractor with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111792351
GHSA-pfr9-2p92-qrhq: Databento Binary Encoding (DBN) has a heap buffer overflow using c_chars_to_str function
The `heap-buffer-overflow` is triggered in the `strlen()` function when handling the `c_chars_to_str` function in the dbn crate. This vulnerability occurs because the `CStr::from_ptr()` function in Rust assumes that the provided C string is null-terminated. However, there is no guarantee that the input chars array passed to the c_chars_to_str function is properly null-terminated.If the chars array does not contain a null byte (\0), strlen() will continue to read beyond the bounds of the buffer in search of a null terminator. This results in an out-of-bounds memory read and can lead to a heap-buffer-overflow, potentially causing memory corruption or exposing sensitive information.
CVSS v4.0: 6.8
CVSS v3.1: 5.5
CVE-2017-20096: WP-SpamFree Anti-Spam Plugin cross site scriting
A vulnerability classified as problematic has been found in WP-SpamFree Anti-Spam Plugin 2.1.1.4. This affects an unknown part. The manipulation leads to basic cross site scripting. It is possible to initiate the attack remotely.
CVSS v3.1: 3.5
GHSA-gvh3-6r75-35q8: A Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) may allow an attacker to spoof a particular Host header, allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.
CVSS v3.0: 7.5
GHSA-94c2-8jj7-8pjp: The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 6.1
GHSA-3hc7-mwwv-ff3c: MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.
GHSA-m54w-cv8c-p4x8: Improper access control in firmware for some Intel(R) Thunderbol(TM) Controllers versions before 41 may allow a privileged user to enable denial of service via local access.
CVSS v3.1: 6.1
CVE-2014-9116: The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
CVSS v2.0: 5
CVE-2001-1495: network_query.php in Network Query Tool 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the target parameter.
CVSS v2.0: 7.5
CVE-2020-25716: A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific group can perform actions restricted only to system administrator. This is the affect of an incomplete fix for CVE-2020-10783. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before cfme 5.11.10.1 are affected
CVSS v3.1: 8.1
CVSS v2.0: 5.5
CVE-2026-25908: Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with Unnecessary Privileges vulnerability in the AWCC. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVSS v3.1: 6.7
GHSA-qx2r-h2pf-6vgp: Multiple Cross-Site Scripting (XSS) vulnerabilities in Hubzilla 7.0.3 and earlier allows remote attacker to include arbitrary web script or HTML via the rpath parameter.
CVSS v3.1: 6.1