ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-v5c7-jpr2-45f7: The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a secure Data Distribution Service (DDS) partition.
CVSS v3.0: 7.5
GHSA-8459-6rc9-8vf8: Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki
ImpactIn the case that a malicious TAL file is parsed pointing to a repository that provides a malicious ROA file which octorpki downloads, it is possible to bypass the current directory traversal mitigation to allow writing outside of the current directory.PatchesNo patch release has been made
GHSA-m6pq-hhvx-694c: The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.
GHSA-98m8-9qp9-q867: A logic issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5. Processing a maliciously crafted image may lead to a denial-of-service.
CVSS v3.1: 5.5
CVE-2024-35191: verbb/formie Server-Side Template Injection for variable-enabled settings
Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text.  This has been fixed in Formie 2.1.6.
CVSS v3.1: 4.4
GHSA-5xvj-wwgx-xf7x: The Logo Slider  WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.
CVSS v3.1: 5.4
CVE-2011-0176: Multiple buffer overflows in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code via a document that contains a crafted embedded Type 1 font.
CVSS v2.0: 6.8
GHSA-rc9r-w4h6-4hqv: The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BlockArt Counter in all versions up to, and including, 2.2.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-grq3-4qg5-2228: In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the LBMPDM dissector could crash. In addition, a remote attacker could write arbitrary data to any memory locations before the packet-scoped memory. This was addressed in epan/dissectors/packet-lbmpdm.c by disallowing certain negative values.
CVSS v3.0: 7.5
GHSA-6f6m-wvhh-pv8v: Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports.
RHSA-2007:1048: Red Hat Security Advisory: openoffice.org, hsqldb security update
JBoss HSQLDB component remote command injection OpenOffice.org-base allows Denial-of-Service and command injection
CVE-2025-13880: WP Social Ninja - Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 4.0.1 - Missing Authorization to Unauthenticated Plugin's Settings Disclosure And Modification
The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings functions in all versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to view and modify plugin's advanced settings.
CVSS v3.1: 6.5
GHSA-849w-8f8x-v945: In impeg2d_mc_fullx_fully of impeg2d_mc.c there is a possible out of bound write due to missing bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS v3.1: 9.8
GHSA-2227-88hv-q85m: A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability could be exploited to enable an XSS attack.
CVE-2015-4601: PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-f8mc-93jh-3m88: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable integer overflow vulnerability in the BitmapData class. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 9.8
CVE-2026-53469: Migration-planner: unprotected delete endpoint wipes all tenant data
A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments, leading to a critical loss of availability and integrity across the entire SaaS platform.
CVSS v3.1: 9.1
GHSA-65qr-c565-757w: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS v3.0: 6.5
CVE-1999-1504: Stalker Internet Mail Server 1.6 allows a remote attacker to cause a denial of service (crash) via a long HELO command.
CVSS v2.0: 5
CVE-2024-49332: WordPress Giveaway Boost plugin <= 2.1.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.
CVSS v3.1: 9.8
GHSA-m8vf-vpr3-f452: A vulnerability was found in SourceCodester Clinics Patient Management System 2.0. It has been classified as problematic. Affected is an unknown function of the file congratulations.php. The manipulation of the argument goto_page leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 4.3
CVE-2025-40154: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

When an invalid value is passed via quirk option, currently
bytcr_rt5640 driver only shows an error message but leaves as is.
This may lead to unepxected results like OOB access.

This patch corrects the input mapping to the certain default value if
an invalid value is passed.
GHSA-5c67-9qgc-qxw3: In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-206128341
CVSS v3.1: 9.8
GHSA-4vrv-4wc3-4q25: Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalation.
CVSS v3.1: 8.8
CVE-2023-28688: WordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.
CVSS v3.1: 5.4
GHSA-fjp8-599f-3qpx: Stack-based Buffer Overflow vulnerability in the ONVIF server component of Victure PC420 smart camera allows an attacker to execute remote code on the target device. This issue affects: Victure PC420 firmware version 1.2.2 and prior versions.
GHSA-932w-6jv2-mm8q: Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.
CVSS v3.1: 5.3
CVE-2020-23894: A User Mode Write AV in ntdll!RtlpCoalesceFreeBlocks+0x268 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2022-25134: A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
RHSA-2008:0599: Red Hat Security Advisory: seamonkey security update
mozilla: CSS reference counter overflow (ZDI-CAN-349)
CVE-2025-48903: Permission bypass vulnerability in the media library module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 7.8
GHSA-2mr3-m5q5-wgp6: Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
SummaryThe use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages.DetailsRegardless of configuration, the flash cookie is checked:The cookie value is hex-decoded and passed directly to msgpack deserialization with no size or content validation:https://github.com/gofiber/fiber/blob/f8f34f642fb3682c341ede7816e7cf861aa7df89/redirect.go#L371The auto-generated `tinylib/msgp` deserialization reads a `uint32` array header from the attacker-controlled byte stream and passes it directly to `make()` with no bounds check:https://github.com/gofiber/fiber/blob/f8f34f642fb3682c341ede7816e7cf861aa7df89/redirect_msgp.go#L242where
 `zb0002, bts, err = msgp.ReadArrayHeaderBytes(bts)` translates the attacker-controlled value into the element count and `make(redirectionMsgs, zb0002)` performs the unbounded allocationSo we can craft a gofiber cookie that will force a huge allocation: `curl -H "Cookie: fiber_flash=dd7fffffff" http://localhost:5000/hello`The cookie val is a hex-encoded msgpack array32 header:`dd` = msgpack array32 marker`7fffffff` = 2 147 483 647 elementsImpactUnauthenticated remote Denial of Service (CWE-789). Anyone running a gofiber v3.0.0 or v3 server is affected. The flash cookie parsing is hardcoded.
CVSS v3.1: 7.5
CVE-2016-20054: Nodcms Cross Site Request Forgery via admin endpoints
Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVE-2023-20977: In btm_ble_read_remote_features_complete of btm_ble_gap.cc, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if the firmware were compromised with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-254445952
CVSS v3.1: 4.4
GHSA-fh54-3vhg-mpc2: PaddlePaddle command injection vulnerability
Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0
CVSS v3.1: 7.8
CVE-2019-12385: An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2026-11793: 389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing
A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFY_SOURCE mitigates this to denial of service only.
CVSS v3.1: 4.9
GHSA-qmcr-92wv-57h8: In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue than CVE-2020-7935 and CVE-2020-8500.
RHSA-2024:5598: Red Hat Security Advisory: libreoffice security update
libreoffice: Ability to trust not validated macro signatures removed in high security mode
CVSS v3.1: 7.8
GHSA-9pj2-3x6v-c3pp: A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 1.3
CVSS v3.1: 5
GHSA-r2m8-pxm9-9c4g: Parse Server has a protected fields bypass via dot-notation in query and sort
ImpactThe `protectedFields` class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values.This affects both MongoDB and PostgreSQL deployments.PatchesThe fix ensures that query WHERE clause keys and sort keys are checked against protected fields by extracting the root field from dot-notation paths. For example, a query on `secretObj.apiKey` is now correctly blocked when `secretObj` is a protected field.WorkaroundsNone.ReferencesGitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-r2m8-pxm9-9c4gFix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.6Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.32
CVSS v4.0: 8.7
GHSA-7c57-5mq4-5xwg: A weakness has been identified in UTT 进取 512W 1.7.7-171114. Affected is the function strcpy of the file /goform/formRemoteControl. This manipulation of the argument Profile causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
GHSA-9gcv-37jm-jgr9: Palm OS 3.5h and possibly other versions, as used in Handspring Visor and Xircom products, allows remote attackers to cause a denial of service via a TCP connect scan, e.g. from nmap.
GHSA-pgj6-rx26-xq27: Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL.
GHSA-m98q-h66m-8mm5: Multiple integer overflows in VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via the (1) MP4 demuxer, (2) Real demuxer, and (3) Cinepak codec, which triggers a buffer overflow.
CVE-2004-2251: The PPTP server in Astaro Security Linux before 4.024 provides information about its version, which makes it easier for remote attackers to construct specialized attacks.
CVSS v2.0: 5
GHSA-hqpc-mh2m-mmv8: Cfingerd with ALLOW_EXECUTION enabled does not properly drop privileges when it executes a program on behalf of the user, allowing local users to gain root privileges.
CVE-2012-4188: Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS v2.0: 9.3
ICSA-23-157-01: Delta Electronics CNCSoft-B DOPSoft
Delta Electronics' DOPSoft versions prior to v4.0.0.82, a component of CNCSoft-B 1.0.0.4,  are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code. Delta Electronics' DOPSoft versions prior to v4.0.0.82, a component of CNCSoft-B 1.0.0.4, are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitrary code. Delta Electronics' CNCSoft-B version 1.0.0.4 DOPSoft versions 4.0.0.82 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
CVSS v3.0: 7.8
CVE-2021-42867: A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
CVE-1999-1526: Auto-update feature of Macromedia Shockwave 7 transmits a user's password and hard disk information back to Macromedia.
CVSS v2.0: 5
GHSA-73qp-34j6-qp6c: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.2.29539. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the NodeProperties::InferReceiverMapsUnsafe method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10950.
GHSA-qrg3-9cf5-hgw8: It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings.
CVSS v3.1: 4.3
CVE-2024-44080: In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loading GIFs from any arbitrary URL if a message from another participant contains a URL encoded in the expected format.
CVSS v3.1: 7.5
CVE-2020-17465: Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4, 6.0.0.6.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2014-1905: Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.
CVSS v2.0: 10
GHSA-w3rv-2cr7-p2wh: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.
CVSS v3.1: 8.1
RHSA-2013:0612: Red Hat Security Advisory: ruby security update
ruby: Incomplete fix for CVE-2011-1005 for NameError#to_s method when used on objects ruby: entity expansion DoS vulnerability in REXML
GHSA-8vfj-m772-gqjw: In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user.
GHSA-r6ff-m2x2-m36p: The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
CVSS v3.1: 6.5
GHSA-78rg-c3vx-jc43: The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismiss_notices() function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to the current time, which may completely take a site offline.
CVSS v3.1: 7.1
GHSA-m63q-r62f-3wj7: In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient
CVSS v3.1: 2.3
GHSA-hhph-6qvj-8859: In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.
CVSS v3.1: 5.5
CVE-2020-0745: An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0715, CVE-2020-0792.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2011-3067: Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to replacement of IFRAME elements.
CVSS v2.0: 6.8
CVE-2023-23442: 

Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.


CVSS v3.1: 4.6
GHSA-rqg4-rgjf-vh9h: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Themify Themify Portfolio Post plugin <= 1.2.4 versions.
CVSS v3.1: 4.1
CVE-2006-1037: SQL injection vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVSS v2.0: 7.5
GHSA-m5f3-m3cw-jgjf: HP Smart Zero Core 4.3 and 4.3.1 on the t410 All-in-One Smart Zero Client, t410 Smart Zero Client, t510 Flexible Thin Client, t5565z Smart Client, t610 Flexible Thin Client, and t610 PLUS Flexible Thin Client allows local users to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
GHSA-j6rw-2m8m-j899: An issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the show_notification_list_issues or show_authorized_issues parameter.
CVE-2025-54973: A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10 and before 7.0.13 allows an attacker to attempt to win a race condition to bypass the FortiCloud SSO authorization via crafted FortiCloud SSO requests.
CVSS v3.1: 5.3
CVE-2019-20071: On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs.
CVSS v3.1: 6.5
CVSS v2.0: 5.8
GHSA-ghv2-6cx6-8wrg: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3.
CVSS v3.1: 8.8
CVE-2019-15573: Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php.
CVSS v3.0: 9.8
CVSS v2.0: 7.5