ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2003-0585: SQL injection vulnerability in login.asp of Brooky eStore 1.0.1 through 1.0.2b allows remote attackers to bypass authentication and execute arbitrary SQL code via the (1) user or (2) pass parameters.
CVSS v2.0: 7.5
GHSA-qmj4-pv85-gqgj: Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.
CVSS v3.1: 7.3
GHSA-rmjq-9c2j-m9mv: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
GHSA-3fv8-vq94-x7xf: The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 7.2
GHSA-p9qw-h5h2-6vw8: Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.
CVSS v3.1: 7.5
GHSA-vp3g-8qhm-pw5j: The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.  NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.
CVE-2022-25354: Prototype Pollution
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
CVSS v3.1: 8.6
GHSA-hg4f-5g6c-7fr2: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-lapd.c has a memory leak.
CVSS v3.0: 7.5
GHSA-vf2p-4grj-v3x6: OpenNMS is accessible via port 9443
GHSA-6c8g-8qxg-99cm: PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).
CVSS v3.1: 6.1
GHSA-28g5-x9hr-ggw6: CliqueMania loja virtual 14 has SQL Injection via the patch/remote.php id parameter in a recomendar action.
CVSS v3.0: 9.8
GHSA-pcxg-vcf2-rp56: GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to Directory.Exists(), allowing the attacker to determine whether arbitrary directories exist on the server.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
GHSA-876r-xj39-ff44: Text Rider 2.4 allows attackers to bypass authentication and upload files without providing a valid password by obtaining the MD5 hash of the password (possibly via another vulnerability that reads it from a data file), then including the hash in a cookie.
CVE-2007-0135: PHP remote file inclusion vulnerability in inc/init.inc.php in Aratix 0.2.2 beta 11 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the current_path parameter.
CVSS v2.0: 6.8
CVE-2025-58201: WordPress AfterShip Tracking Plugin <= 1.17.17 - Broken Access Control Vulnerability
Missing Authorization vulnerability in AfterShip & Automizely AfterShip Tracking aftership-woocommerce-tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AfterShip Tracking: from n/a through <= 1.17.17.
CVSS v3.1: 5.3
RHSA-2022:1777: Red Hat Security Advisory: webkit2gtk3 security, bug fix, and enhancement update
webkitgtk: Use-after-free leading to arbitrary code execution webkitgtk: Type confusion issue leading to arbitrary code execution webkitgtk: Logic issue leading to HSTS bypass webkitgtk: Out-of-bounds read leading to memory disclosure webkitgtk: Memory corruption issue leading to arbitrary code execution webkitgtk: Memory corruption issue leading to arbitrary code execution webkitgtk: Multiple memory corruption issue leading to arbitrary code execution webkitgtk: Memory corruption issue leading to arbitrary code execution webkitgtk: CSS compositing issue leading to revealing of the browsing history webkitgtk: Logic issue leading to Content Security Policy bypass webkitgtk: Information leak via Content Security Policy reports webkitgtk: Buffer overflow leading to arbitrary code execution webkitgtk: Logic issue leading to universal cross-site scripting webkitgtk: Cross-origin data exfiltration via resource timing API webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create webkitgtk: use-after-free in WebCore::ContainerNode::firstChild webkitgtk: use-after-free in WebCore::Frame::page webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced webkitgtk: A malicious website may exfiltrate data cross-origin webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free webkitgtk: logic issue was addressed with improved state management
CVSS v3.1: 8.8
GHSA-w4fp-j2mm-3rrv: Cisco Catalyst 2900XL switch allows a remote attacker to create a denial of service via an empty UDP packet sent to port 161 (SNMP) when SNMP  is disabled.
GHSA-7p79-6x2v-5h88: Server crash if running Python 3.10 w/ Sanic 20.12
**!!! ONLY APPLIES TO VERSIONS PRIOR TO Sanic v20.12 WHEN USING Python 3.10 !!!**Sanic v20.12 officially supports Python versions 3.6, 3.7, 3.8, and 3.9. However, if you accidentally run it with version 3.10 (**which is not supported by Sanic 20.12**), your server is prone to crashing on an incoming web request.ImpactAnyone running Sanic server between 0.1.7 and 20.12 **using Python 3.10**.Patches[Sanic v20.12.6](https://github.com/sanic-org/sanic/releases/tag/v20.12.6)WorkaroundsUse a supported version of Python (v3.6 - v3.9)ReferencesIn [asyncio](https://docs.python.org/3/library/asyncio.html#module-asyncio), the explicit passing of a loop argument has been deprecated and will be removed in version 3.10 for the following: ... [asyncio.Event](https://docs.python.org/3/library/asyncio-sync.html#asyncio.Event)[Python 3.8 Release Notes](https://docs.python.org/3/whatsnew/3.8.html#deprecated)For more informationIf you have any questions or comments about this advisory:Open an issue in [the community forums](https://community.sanicframework.org/)Ping us on [the Discord server](https://discord.gg/FARQzAEMAA)
CVE-2005-4883: Race condition in Philippe Jounin Tftpd32 before 2.80 allows remote attackers to cause a denial of service (daemon crash) via invalid "connect frames."
CVSS v2.0: 4.3
CVE-2024-41910: A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices.  The firmware contained multiple XSS vulnerabilities in the version of JavaScript used.
CVSS v3.1: 6.1
GHSA-q9jr-grx6-5j7q: IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  247861.
CVSS v3.1: 4.6
CVE-2024-6438: Hitout Carsale OrderController.java sql injection
A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-270166 is the identifier assigned to this vulnerability.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-7gp9-qpvg-436r: libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.
CVE-2001-0397: Buffer overflow in Silent Runner Collector (SRC) 1.6.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long SMTP HELO command.
CVSS v2.0: 7.5
GHSA-82fm-6qgx-7w8m: SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via ics_export.php.
CVSS v3.1: 9.8
CVE-2024-8661: Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload  by executing it in the browsers of targeted users. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6 with vector  CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N  Since the "Next&Previous Nav" block output was not sufficiently sanitized, the malicious payload could be executed in the browsers of targeted users. Thanks, Chu Quoc Khanh for reporting.
CVSS v4.0: 4.6
CVE-2005-4560: The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com.
CVSS v2.0: 7.5
CVE-2008-3948: SQL injection vulnerability in admin/users/self-2.php in XRMS allows remote attackers to execute arbitrary SQL commands and modify name and email fields via unspecified vectors.
CVSS v2.0: 7.5
GHSA-q9v7-qrhr-3q9v: In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.
CVSS v3.1: 5.9
CVE-2025-68056: WordPress LBG Zoominoutslider plugin <= 5.4.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LBG Zoominoutslider lbg_zoominoutslider allows SQL Injection.This issue affects LBG Zoominoutslider: from n/a through <= 5.4.4.
CVSS v3.1: 8.5
GHSA-63hq-456x-7wc8: HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when successfully exploited allows an attacker to inject random HTML code into a component loaded by WebView, thus allowing the Application to display web resources controlled by the attacker.
GHSA-7f8g-xqpj-293g: Microsoft SharePoint Server Spoofing Vulnerability This CVE ID is unique from CVE-2021-43242.
CVSS v3.1: 5.7
GHSA-x3r8-x2r5-jj28: Multiple directory traversal vulnerabilities in WebPortal CMS 0.8-beta allow remote attackers to (1) read arbitrary files via directory traversal sequences in the lang parameter to libraries/helpdocs/help.php and (2) include and execute arbitrary local files via directory traversal sequences in the error parameter to index.php.
RHSA-2014:1956: Red Hat Security Advisory: wpa_supplicant security update
hostapd: wpa_cli and hostapd_cli remote command execution issue
CVE-2026-49851: Mistune: Potential DoS via quadratic-time parsing in parse_link_text
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.
CVSS v4.0: 8.7
GHSA-q6hr-vm49-fvm5: A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of specific packets with a Transparent Interconnection of Lots of Links (TRILL) OAM EtherType. An attacker could exploit this vulnerability by sending crafted packets, including the TRILL OAM EtherType of 0x8902, to a device that is part of a VXLAN Ethernet VPN (EVPN) fabric. A successful exploit could allow the attacker to cause an affected device to experience high CPU usage and consume excessive system resources, which may result in overall control plane instability and cause the affected device to reload. Note: The NGOAM feature is disabled by default.
GHSA-3gxc-gprv-rpqq: The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, aka SPR KLYHA7MM3J.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0920.
CVSS v3.0: 8.1
GHSA-x38q-hvmx-rwhg: Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
GHSA-3543-r684-9c6x: Unspecified vulnerability in a JavaScript method in Adobe Reader and Acrobat 8.1.2 and earlier, and before 7.1.1, allows remote attackers to execute arbitrary code via unknown vectors, related to an "input validation issue."
CVE-2025-64049: A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.
CVSS v3.1: 4.8
GHSA-rr47-f45w-r9gx: Unspecified vulnerability in the Client Service for DPM in Hitachi ServerConductor / Deployment Manager 01-00, 01-01, and 06-00 through 06-00-/A; ServerConductor / Deployment Manager Standard Edition and Enterprise Edition 07-50 through 07-55, and 07-57 through 07-59; and JP1/ServerConductor/Deployment Manager Standard and Enterprise Edition 07-50 through 07-56-/F, 08-00 through 08-09-/E, 08-50 through 08-80-/A, 08-06 through 08-07, and 08-51 through 08-70; allows attackers to cause a denial of service (shutdown and reboot) via unknown vectors.
GHSA-5r8w-6xfr-q973: magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.
CVSS v3.1: 5.5
CVE-2019-12099: In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload.
CVSS v3.0: 8.8
CVSS v2.0: 9
GHSA-wjh9-35xc-wcv8: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when certain configurations exist.
CVSS v3.1: 5.3
GHSA-rgrv-q697-h79q: Vulnerability in the XFS file system for SGI IRIX before 6.5.12 allows local users to cause a denial of service (hang) by creating a file that is not properly processed by XFS.
GHSA-rq9j-q9jw-98mf: In the camera, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150156131
GHSA-qhrx-h236-jpc8: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound ARPrice allows Reflected XSS. This issue affects ARPrice: from n/a through 4.0.3.
CVSS v3.1: 7.1
CVE-2025-60335: A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVSS v3.1: 7.5
GHSA-cmcf-8m42-xc3h: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Takashi Matsuyama My Favorites allows Stored XSS.This issue affects My Favorites: from n/a through 1.4.1.
CVSS v3.1: 6.5
GHSA-qxr6-vhx6-6r6g: An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. A specially crafted index value can cause an invalid memory read, resulting in a denial of service or remote information disclosure. An unauthenticated attacker can send a crafted packet on the local network to trigger this vulnerability.
CVSS v3.0: 9.1
GHSA-ffc2-v2cp-6fq5: The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. An app may be able to gain elevated privileges.
CVSS v3.1: 8.4
GHSA-rrxc-cq4j-w35w: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to modify protected parts of the file system.
CVSS v3.1: 7.7
CVE-2025-63334: PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The application fails to sanitize user input in the opacityValue POST parameter before passing it to a shell command, allowing remote attackers to execute arbitrary commands with root privileges on the underlying system.
CVSS v3.1: 9.8
CVE-2020-5326: Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager.
CVSS v3.1: 6.1
CVE-2026-2301: Post Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter
The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. This is due to the `duplicate_post()` function in `includes/api.php` using `$wpdb->insert()` directly to the `wp_postmeta` table instead of WordPress's standard `add_post_meta()` function, which would call `is_protected_meta()` to prevent lower-privileged users from setting protected meta keys (those starting with `_`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary protected post meta keys such as `_wp_page_template`, `_wp_attached_file`, and other sensitive meta keys on duplicated posts via the `customMetaData` JSON array parameter in the `/wp-json/post-duplicator/v1/duplicate-post` REST API endpoint.
CVSS v3.1: 4.3
CVE-2022-36399: WordPress Booked Plugin < 2.4.4 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.
CVSS v3.1: 5.3
GHSA-vccx-ghmw-f5j8: In the Linux kernel, the following vulnerability has been resolved:libceph: prevent potential out-of-bounds writes in handle_auth_session_key()The len field originates from untrusted network packets. Boundary
checks have been added to prevent potential out-of-bounds writes when
decrypting the connection secret or processing service tickets.[ idryomov: changelog ]
CVE-2018-13007: An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (not conditional on a buffer_size_longs check).
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-fwhm-xh8g-8m5q: The PowerVR GPU kernel driver in pvrsrvkm.ko through 2021-04-24 for the Linux kernel, as used on Alcatel 1S phones, allows attackers to overwrite heap memory via PhysmemNewRamBackedPMR.
CVSS v3.1: 7
GHSA-6v98-88gr-xr2r: A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via the host_name and service_description parameters. The vulnerability can be exploited only when a valid Knowledge Base URL is configured on the Knowledge Base configuration page and points to a MediaWiki instance. This relates to the proxy feature in class/centreon-knowledge/ProceduresProxy.class.php and include/configuration/configKnowledge/proxy/proxy.php.
GHSA-h86p-h6mg-qw33: Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms allows Cross Site Request Forgery. This issue affects NEX-Forms: from n/a through 9.1.3.
CVSS v3.1: 8.8
CVE-2020-14209: Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).
CVSS v3.1: 8.8
CVSS v2.0: 6.5
CVE-2022-34445: 

Dell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password. A malicious local privileged attacker may potentially exploit this vulnerability, leading to information disclosure.






CVSS v3.1: 6
GHSA-qqwv-mgrm-5xch: A vulnerability was found in StarSea99 starsea-mall 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/categories/update. The manipulation of the argument categoryName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 2.4
GHSA-4rwq-m5m5-h79g: phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file.
GHSA-f4w8-g7fj-mpg4: Veritas Desktop and Laptop Option (DLO) before 9.5 disclosed operational information on the backup processing status through a URL that did not require authentication.