ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-hqr9-c56f-3x7f: @angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`'s DOM emulation dependency (`domino`) when serializing the content of raw-text elements (such as `<script>`, `<style>`, and `<iframe>`).`domino` supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a **Unicode index alignment bug** existed in this escaping logic.In JavaScript, string lengths and character indices are calculated based on UTF-16 code units (where astral characters—such as emojis—occupy 2 code units / 4 bytes). If the bound dynamic text contained astral Unicode characters _before_ the closing tag (e.g. `</script>`, `</style>`, or `</iframe>`), the index offset calculation in `domino`'s replacement logic shifted.This misalignment caused `domino` to fail to replace or escape the closing tag, leaving it raw and unescaped in the output HTML.An attacker who controls the dynamic text can supply a payload containing both an astral Unicode character and a closing tag (e.g., `😀</iframe><script>alert(1)</script>`). When serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text context early, and executes the subsequent `<script>` block, leading to same-origin Cross-Site Scripting (XSS).ImpactThis vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside raw-text elements. This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.Patched Versions22.0.0-rc.221.2.1620.3.2419.2.25WorkaroundsIf you cannot immediately update your dependencies, you can:Avoid binding user-controlled values inside `<iframe>` or other raw-text elements.Sanitize any user input placed inside raw-text elements to explicitly strip closing tags before passing it to the template.
CVSS v4.0: 8.6
GHSA-4v8h-358m-9fvj: SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter.
CVE-2018-17049: CQU-LANKERS through 2017-11-02 has XSS via the public/api.php callback parameter in an uploadpic action.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2018-6693: Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escalation to delete arbitrary files.
CVSS v3.0: 5.6
GHSA-725f-3pw7-rq6x: Malicious Package in 8.9.4
Versions 1.0.2, 1.0.3, 1.0.4 and 1.0.5 of `8.9.4` contain malicious code as a preinstall script. The package reads the system's SSH keys but does not upload it to a remote server.RecommendationRemove the package from your environment. There is no evidence of further compromise at the moment.
CVSS v3.1: 9.8
GHSA-5v5x-x8hh-7ffj: In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file
CVSS v3.1: 3.3
CVE-2017-13211: In bta_scan_results_cb_impl of btif_ble_scanner.cc, there is possible resource exhaustion if a large number of repeated BLE scan results are received. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0. Android ID: A-65174158.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
RHSA-2011:0213: Red Hat Security Advisory: jbossweb security update
JDK Double.parseDouble Denial-Of-Service
CVE-2025-23819: WordPress WP Cloud plugin <= 1.4.3 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Marco Milesi WP Cloud cloud allows Absolute Path Traversal.This issue affects WP Cloud: from n/a through <= 1.4.3.
CVSS v3.1: 7.5
GHSA-jqmf-8rw2-2qx7: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a check on a function return value is missing, potentially allowing an uninitialized value to be used as the source of a strcpy() call, leading to denial of service or information disclosure.
CVSS v3.0: 6.1
CVE-2019-20934: An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c.
CVSS v3.1: 5.3
CVSS v2.0: 5.4
CVE-2024-54434: WordPress phZoom plugin <= 1.2.92 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in BenJemin phZoom phzoom allows Stored XSS.This issue affects phZoom: from n/a through <= 1.2.92.
CVSS v3.1: 7.1
GHSA-r4fg-vv8f-f6xx: An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could exploit the vulnerable function in order to prepare an XSS payload to send to the product's clients.
CVSS v3.0: 6.1
GHSA-v84f-5mrr-763p: The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_refund_status' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update refund statuses to approved or rejected.
CVSS v3.1: 4.3
CVE-2025-23306: NVIDIA Megatron-LM for all platforms contains a vulnerability in the megatron/training/
arguments.py component where an attacker could cause a code injection issue by providing a malicious input. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS v3.1: 7.8
CVE-2008-3319: admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary links_cookie cookie.
CVSS v2.0: 7.5
CVE-2007-3376: Buffer overflow in Apple Safari 3.0.2 on Windows XP SP2 allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long value in the title HTML tag, which triggers the overflow when the user adds the page as a bookmark.
CVSS v2.0: 9.3
GHSA-6cr6-fmvc-vw2p: Noise vulnerable to denial of service
Noise is a Go implementation of the Noise Protocol Framework. The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 (~18.4 quintillion) messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce. In a separate issue, the Decrypt function increments the nonce state even when it fails to decrypt a message. If an attacker can provide an invalid input to the Decrypt function, this will cause the nonce state to desynchronize between the peers, resulting in a failure to encrypt all subsequent messages.
CVSS v3.1: 7.7
CVE-2025-20200: A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device.
 This vulnerability is due to insufficient input validation when processing specific configuration commands. An attacker could exploit this vulnerability by including crafted input in specific configuration commands. A successful exploit could allow the attacker to elevate privileges to root on the underlying operating system of an affected device. The security impact rating (SIR) of this advisory has been raised to High because an attacker could gain access to the underlying operating system of the affected device and perform potentially undetected actions.
 Note: The attacker must have privileges to enter configuration mode on the affected device. This is usually referred to as privilege level 15.
CVSS v3.1: 6.7
RHSA-2021:0395: Red Hat Security Advisory: RHV-H security, bug fix, enhancement update (redhat-virtualization-host) 4.3.13
dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker sudo: Heap buffer overflow in argument parsing
CVSS v3.1: 7.8
CVE-2025-1241: Encryption vulnerable to brute-force decryption in GoAnywhere MFT
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
CVSS v3.1: 5.8
CVE-2026-9662: Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter
The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled `tpf` POST parameter before it is used in an `include()` path in the `recover_exit()` function. This makes it possible for unauthenticated attackers to perform path traversal and include unintended local PHP files, which can lead to sensitive information exposure and, in certain deployment chains, code execution.
CVSS v3.1: 8.1
CVE-2025-65825: The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet device can disassemble the device, connect over UART, and retrieve the firmware dump for analysis. Within the NVS partition they may discover the credentials of the current and previous Wi-Fi networks. This information could be used to gain unauthorized access to the victim's Wi-Fi network.
CVSS v3.1: 4.6
GHSA-vw24-x99x-q736: PHP remote file inclusion vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the wpPATH parameter.
GHSA-qwxf-m68g-w6v5: The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.
CVSS v3.1: 5.4
GHSA-g9wh-q9v4-pqc7: Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) have a Cross-Site Request Forgery (CSRF) vulnerability that could lead to a denial of service (DOS) or device misconfiguration.
CVE-2014-7644: The Go MSX MLS (aka com.doapps.android.realestate.RE_16b9c09c4d5b0e174208f35e7c49f9a0) application 2.3.4.MR3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2019-5314: Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS. An attacker would be able to accomplish this by sending certain URL parameters that would trigger this vulnerability.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2024-12092: Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x
A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS v3.1: 8.7
CVE-2019-4719: IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data.
CVSS v3.0: 5.1
CVE-2008-5217: Directory traversal vulnerability in index.php in txtCMS 0.3, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter.
CVSS v2.0: 5.1
GHSA-cf2j-m586-269w: In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_conncount: update last_gc only when GC has been performedCurrently last_gc is being updated everytime a new connection is
tracked, that means that it is updated even if a GC wasn't performed.
With a sufficiently high packet rate, it is possible to always bypass
the GC, causing the list to grow infinitely.Update the last_gc value only when a GC has been actually performed.
CVSS v3.1: 5.5
GHSA-5c8p-39hp-f8q8: Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.1) allows remote attackers to cause a denial of service (device reboot) via malformed SNMP requests.
CVE-2021-28832: VSCodeVim before 1.19.0 allows attackers to execute arbitrary code via a crafted workspace configuration.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
CVE-2024-39712: Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS v3.0: 9.1
CVE-2008-2678: Multiple SQL injection vulnerabilities in Telephone Directory 2008, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) code parameter in a confirm_data action to edit1.php and the (2) id parameter to view_more.php.
CVSS v2.0: 7.5
GHSA-rfw9-259h-m9m6: Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service (crash) via a long string in the URI in a GET request.
CVE-2016-6128: The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-v64h-qhh7-j6qf: An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24695. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user.
CVSS v3.1: 5.4
CVE-2006-5354: Unspecified vulnerability in Oracle HTTP Server 9.2.0.7 and 10.1.0.5, Application Server 9.0.4.3, 10.1.2.0.2, 10.1.2.1.0, and 10.1.3.0, racle Collaboration Suite 9.0.4.2 and 10.1.2, and Oracle E-Business Suite and Applications 11.5.10CU2 has unknown impact and remote attack vectors, aka Vuln# OHS06.
CVSS v2.0: 10
GHSA-v4gx-744x-jr2m: In the Linux kernel, the following vulnerability has been resolved:net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completionrds_ib_xmit_atomic() always programs a masked atomic opcode
(IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD)
for every RDS atomic cmsg.  But the completion-side switch in
rds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked
atomic completion falls through to default and returns rm == NULL while
send->s_op is left set.  rds_ib_send_cqe_handler() then dereferences the
NULL rm via rm->m_final_op, oopsing in softirq context.  An unprivileged
AF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection
triggers it; on hardware that natively accepts masked atomics (mlx4,
mlx5) no extra setup is needed.RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!
  Oops: general protection fault [#1] SMP KASAN
  KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
  RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282)
  Call Trace:
   <IRQ>
   rds_ib_send_cqe_handler (net/rds/ib_send.c:282)
   poll_scq (net/rds/ib_cm.c:274)
   rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294)
   tasklet_action_common (kernel/softirq.c:943)
   handle_softirqs (kernel/softirq.c:573)
   run_ksoftirqd (kernel/softirq.c:479)
   </IRQ>
  Kernel panic - not syncing: Fatal exception in interruptHandle the masked atomic opcodes in the same case as the non-masked
ones: they map to the same struct rds_message.atomic union member, so
the existing container_of()/rds_ib_send_unmap_atomic() body is correct
for them.
CVE-2002-2339: Cross-site scripting (XSS) vulnerability in configure.asp in Script-Shed GuestBook 1.0 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in (1) image, (2) img, (3) image=right, (4) img=right, (5) image=left, and (6) img=left tags.
CVSS v2.0: 4.3
PYSEC-2021-374: Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
CVE-2007-6232: Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web script or HTML via the error parameter in an error page action.
CVSS v2.0: 4.3
GHSA-4wp3-4j8h-5x7r: In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact.
CVSS v3.0: 8.8
GHSA-9cm4-3grc-hcrr: Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview Plainview Protect Passwords.This issue affects Plainview Protect Passwords: from n/a through 1.4.
CVSS v3.1: 6.5
CVE-2025-63624: SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker to execute arbitrary code via the imei_list.aspx file.
CVSS v3.1: 9.8
CVE-2024-23480: Insecure MacOS code sign check fallback 
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2.

CVSS v3.1: 7.5
CVE-2021-28802: Command Injection Vulnerabilities in QTS and QuTS hero
A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2025-55742: UnoPim Stored XSS via SVG MIME/Sanitizer Bypass
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1.
CVSS v3.1: 8
GHSA-xp4q-qhv3-758q: An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing the attacker to obtain administrative privileges on the device.
CVSS v3.0: 9.8
CVE-2011-3812: Vanilla 2.0.16 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Minify/min/utils.php and certain other files.
CVSS v2.0: 5
CVE-2020-36749: Easy Testimonials <= 3.6.1 - Cross-Site Request Forgery Bypass
The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
GHSA-8h98-mv3j-75c6: PrintHTML API Remote Code Execution Vulnerability
CVSS v3.1: 7.8
CVE-2024-20968: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options).  Supported versions that are affected are 8.0.34 and prior and  8.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.4
GHSA-7f79-rvx6-vxc4: Duplicate Advisory: Picklescan does not block ctypes
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-4675-36f9-wf6r. This link is maintained to preserve external references.Original Descriptionpicklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbox protections and gadget chain detection.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
RHSA-2014:1194: Red Hat Security Advisory: conga security and bug fix update
(Plone): Restricted Python injection (Plone): Reflexive HTTP header injection (Plone): Restricted Python injection (Plone): Anonymous users can list user account names (Plone): Partial denial of service through Collections functionality (Plone): Partial denial of service through internal function (Plone): Anonymous users can batch change titles of content items conga: Multiple information leak flaws in various luci site extensions luci: unauthorized administrative access granted to non-administrative users
CVE-2023-48657: An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters.
CVSS v3.1: 9.8
CVE-2020-10423: The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/manage-feedbacks.php by adding a question mark (?) followed by the payload.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
GHSA-r7wx-4mj5-7j6j: Buffer overflow in NFS readlink handling in the Linux Kernel 2.4 up to 2.4.31 allows remote NFS servers to cause a denial of service (crash) via a long symlink, which is not properly handled in (1) nfs2xdr.c or (2) nfs3xdr.c and causes a crash in the NFS client.
CVE-2022-48681: Some Huawei smart speakers have a memory overflow vulnerability. Successful exploitation of this vulnerability may cause certain functions to fail.
CVSS v3.1: 7.2
CVE-2024-47907: A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service.
CVSS v3.1: 7.5
GHSA-pr3m-646v-qvfc: Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.
GHSA-rm8g-9wjh-m3gc: Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability."
CVE-2024-40810: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.6. An app may be able to cause a coprocessor crash.
CVSS v3.1: 5.5
CVE-2025-45618: Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive information via a crafted payload.
CVSS v3.1: 6.5