ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2018-1000022: Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC interface that can result in Bitcoin theft, if the user's wallet is not password protected. This attack appear to be exploitable via The victim must visit a web page with specially crafted javascript. This vulnerability appears to have been fixed in 3.0.5.
CVSS v3.0: 5.3
CVSS v2.0: 2.6
GHSA-c2gg-4gq4-jv5j: XWiki Platform remote code execution from account through UIExtension parameters
ImpactParameters of UI extensions are always interpreted as Velocity code and executed with programming rights. Any user with edit right on any document like the user's own profile can create UI extensions. This allows remote code execution and thereby impacts the confidentiality, integrity and availability of the whole XWiki installation.To reproduce, edit your user profile with the object editor and add a UIExtension object with the following values:Save the document and open any document. If an application entry with the text "I got programming right: true" is displayed, the attack succeeded, if the code in "label" is displayed literally, the XWiki installation isn't vulnerable.PatchesThis vulnerability has been patched in XWiki 14.10.19, 15.5.4 and 15.9-RC1.WorkaroundsWe're not aware of any workarounds apart from upgrading.Referenceshttps://jira.xwiki.org/browse/XWIKI-21335https://github.com/xwiki/xwiki-platform/commit/171e7c7d0e56deaa7b3678657ae26ef95379b1ea
CVSS v3.1: 9.9
CVE-2016-8940: IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacker is able to submit SQL queries that access database tables that are not intended for access or use by administrators. The access of these product specific database tables may allow access to passwords or other sensitive information for the product. IBM Reference #: 1998946.
CVSS v3.0: 8.8
CVSS v2.0: 4
GHSA-fffh-vg75-287f: Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.
CVSS v3.1: 7.1
CVE-2020-36691: An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink policy with a back reference.
CVSS v3.1: 5.5
CVE-2025-8571: Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page
Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks  Fortbridge https://fortbridge.co.uk/  for performing a penetration test and vulnerability assessment on Concrete CMS and reporting this issue.
CVSS v4.0: 4.8
RHSA-2023:7622: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.7 release and security update
openssl: Denial of service by excessive resource usage in verifying X509 policy constraints openssl: Invalid certificate policies in leaf certificates are silently ignored openssl: Certificate policy check not enabled openssl: Possible DoS translating ASN.1 object identifiers openssl: Excessive time spent checking DH keys and parameters OpenSSL: Excessive time spent checking DH q parameter value tomcat: Open Redirect vulnerability in FORM authentication
CVSS v3.1: 6.1
GHSA-wjmr-v62x-4f45: The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all versions up to, and including, 3.2.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose draft post titles and excerpts.
CVSS v3.1: 4.3
CVE-2024-28672: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php.
CVSS v3.1: 5.4
GHSA-7w5w-v49g-pq2m: Heap-based buffer overflow in the CreateFXPDFConvertor function in ConvertToPdf_x86.dll in Foxit Reader 7.3.4.311 allows remote attackers to execute arbitrary code via a large SamplesPerPixel value in a crafted TIFF image that is mishandled during PDF conversion. This is fixed in 8.0.
CVSS v3.0: 7.8
CVE-2023-33911: In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
CVSS v3.1: 5.5
CVE-2024-43377: Umbraco CMS Improper Access Control vulnerability
Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2.
CVSS v3.1: 5.4
GHSA-98f5-9jjv-x473: A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.6. A local user may be able to cause unexpected system termination or read kernel memory.
CVE-2025-65562: The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID (e.g., 0xFFFFFFFFFFFFFFFF) that causes an integer conversion/underflow in LocalNode.DeleteSess() / LocalNode.Sess() when a uint64 SEID is converted to int and used in index arithmetic. This leads to a negative index into n.sess and a Go runtime panic, resulting in a denial of service (UPF crash). The issue has been reproduced on free5GC v4.1.0 with crashes observed in the session lookup/deletion path in internal/pfcp/node.go; other versions may also be affected. No authentication is required.
CVSS v3.1: 7.5
GHSA-cjg8-m6hh-w76f: The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.
CVE-2022-3662: Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after free
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
CVSS v3.1: 7.3
RHSA-2026:3427: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.0 release
golang: net/url: Memory exhaustion in query parameter parsing in net/url
CVSS v3.1: 7.5
GHSA-xfr9-hqm4-5288: The Flower Delivery by Florist One WordPress plugin through 3.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setups)
CVSS v3.1: 4.8
GHSA-f9mf-vhr2-gvqj: INDEXU 2.0 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the cookie_admin_authenticated cookie value to 1.
CVE-2025-69317: WordPress CarSpot theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This issue affects CarSpot: from n/a through < 2.4.6.
CVSS v3.1: 7.1
CVE-2007-1165: Multiple PHP remote file inclusion vulnerabilities in DBGuestbook 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the dbs_base_path parameter to (1) utils.php, (2) guestbook.php, or (3) views.php in includes/.
CVSS v2.0: 7.5
GHSA-4525-66vv-3hwf: FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c.
CVSS v3.1: 7.5
GHSA-m9pj-67cf-px2x: nls_ascii.c in Linux before 2.6.8.1 uses an incorrect table size, which allows attackers to cause a denial of service (kernel crash) via a buffer overflow.
GHSA-v4hf-m89f-x363: Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device.
CVSS v3.1: 7.5
GHSA-7j8m-fm49-xgmg: MantisBT Incorrect Authorization for bug_revision_view_page.php check
An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php allows an unprivileged attacker to view the Summary field of private issues, as well as bugnotes revisions, gaining access to potentially confidential information via the bugnote_id parameter.
CVSS v3.1: 7.5
CVE-2024-31202: A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege Escalation.
CVSS v3.1: 7.8
GHSA-vj56-2v5w-wg83: The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1(112) and Cisco Prime Security Manager (PRSM) software before 9.3.1.1(112) allows remote authenticated users to change arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuo94842.
CVSS v3.0: 8.8
GHSA-9hmw-83v5-qm22: The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin_init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress's magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode.
CVSS v3.1: 6.4
CVE-2022-38107: Sensitive Data Disclosure Vulnerability
Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details.
CVSS v3.1: 5.3
GHSA-ccx3-fw7q-rr2r: OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks
ImpactMultiple Code Paths Missing Base64 Pre-Allocation Size Checks.Several base64 decode paths could allocate before enforcing decoded-size limits.OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.Affected Packages / VersionsPackage: `openclaw` (npm)Affected versions: `<=v2026.4.2`Patched versions: `2026.4.8`FixThe issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.VerificationThe fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.CreditsThanks @zsxsoft and @KeenSecurityLab for reporting.
CVSS v4.0: 5.1
CVSS v3.1: 4.3
GHSA-3c6j-3hg7-vq95: A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component.
CVSS v4.0: 4.8
CVSS v3.1: 5.3
GHSA-h6rg-3v58-mp3f: In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
CVE-2024-29814: WordPress Exchange Rates Widget plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Exchange Rates Widget allows Stored XSS.This issue affects Exchange Rates Widget: from n/a through 1.4.0.
CVSS v3.1: 6.5
CVE-2020-0330: In iorap, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege and code execution with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150331085
CVSS v3.1: 6.7
CVSS v2.0: 4.6
GHSA-jjjx-p2hc-qwfw: Photos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during deletions, which allows physically proximate attackers to obtain sensitive photo data by launching the Photos app and looking under a transparent image.
CVE-2018-5857: In the WCD CPE codec, a Use After Free condition can occur in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
CVSS v3.0: 7.8
CVSS v2.0: 4.6
CVE-2013-0215: oxenstored in Xen 4.1.x, Xen 4.2.x, and xen-unstable does not properly consider the state of the Xenstore ring during read operations, which allows guest OS users to cause a denial of service (daemon crash and host-control outage, or memory consumption) or obtain sensitive control-plane data by leveraging guest administrative access.
CVSS v2.0: 4.3
CVE-2020-24655: A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny an access request prior to unlocking the application with a PIN on older Android devices (effectively bypassing the PIN requirement).
CVSS v3.1: 5.1
CVSS v2.0: 1.9
CVE-2001-0530: Spearhead NetGAP 200 and 300 before build 78 allow a remote attacker to bypass file blocking and content inspection via specially encoded URLs which include '%' characters.
CVSS v2.0: 5
GHSA-9jqp-8h2q-6wcg: Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board (IPB or IP.Board) 2.2.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via (1) module_bbcodeloader.php, (2) module_div.php, (3) module_email.php, (4) module_image.php, (5) module_link.php, or (6) the editorid parameter to module_table.php in jscripts/folder_rte_files/.  NOTE: some details were obtained from third party sources.
CVE-2022-21891: Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability
Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability
CVSS v3.1: 7.6
GHSA-64cg-x9wj-m2fx: Auth. SQL Injection (SQLi) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions.
CVSS v3.1: 7.2
CVE-2018-20732: SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
RHSA-2025:15062: Red Hat Security Advisory: postgresql:15 security update
postgresql: PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table postgresql: PostgreSQL code execution in restore operation postgresql: PostgreSQL executes arbitrary code in restore operation
CVSS v3.1: 8.8
GHSA-p8hj-rw4c-xgr5: Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the public_html/doc/index.html.
CVSS v3.1: 6.1
CVE-2011-5241: Services_Twitter 0.6.3 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS v2.0: 5.8
CVE-2014-6787: The Counter Intuition (aka com.counter.intuition) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2020-18768: There exists one heap buffer overflow in _TIFFmemcpy in tif_unix.c in libtiff 4.0.10, which allows an attacker to cause a denial-of-service through a crafted tiff file.
CVSS v3.1: 5.5
CVE-2026-0710: Sipp/sipp: sipp: denial of service and potential arbitrary code execution vulnerability
A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol (SIP) messages during an active call. This vulnerability, a NULL pointer dereference, can cause the application to crash, leading to a denial of service. Under specific conditions, it may also allow an attacker to execute unauthorized code, compromising the system's integrity and availability.
CVSS v3.1: 8.4
CVE-2025-13238: Bdtask Flight Booking Software Edit Profile edit unrestricted upload
A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit of the component Edit Profile Page. This manipulation causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2022-26533: Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
RHSA-2023:7473: Red Hat Security Advisory: OpenShift Container Platform 4.14.4 packages and security update
python-werkzeug: high resource usage when parsing multipart form data with many fields haproxy: Proxy forwards malformed empty Content-Length headers python-werkzeug: high resource consumption leading to denial of service
CVSS v3.1: 7.5
GHSA-9479-m26h-g85h: The Multi Post Carousel by Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides' shortcode attribute in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on the user-supplied 'slides' parameter in the post_slides_shortcode function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2021-30534: Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-x289-qg3r-9vgq: Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to
execute arbitrary commands via a specific interface,
potentially enabling the attacker to access, modify, or delete sensitive
information within the database.
CVSS v3.1: 7.2
CVE-2024-32489: TCPDF before 6.7.4 mishandles calls that use HTML syntax.
CVSS v3.1: 6.1
GHSA-hmm6-p5gh-p2h9: Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability
CVSS v3.1: 7.3
GHSA-hrh3-h5hp-c3mg: libjpeg-turbo 2.0.1 has a heap-based buffer over-read in the put_pixel_rows function in wrbmp.c, as demonstrated by djpeg.
CVSS v3.0: 6.5
CVE-2015-8002: The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.
CVSS v2.0: 6.8
GHSA-g7c8-49c3-qh57: Buffer overflow in Acoustica MP3 CD Burner 4.32 allows user-assisted remote attackers to execute arbitrary code via a .asx playlist file with a REF element containing a long string in the HREF attribute. NOTE: it was later claimed that 4.51 Build 147 is also affected.
GHSA-hxf8-59h5-6g9v: BEESCMS 4.0 has a CSRF vulnerability to add an administrator account via the admin/admin_admin.php?nav=list_admin_user&admin_p_nav=user URI.
CVSS v3.0: 8.8
GHSA-vvwv-h69m-wg6f: XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ?<!ENTITY? and thus allowing for an xml external entity processing (XXE) attack.
CVSS v3.1: 8.8
CVE-2003-1161: exit.c in Linux kernel 2.6-test9-CVS, as stored on kernel.bkbits.net, was modified to contain a backdoor, which could allow local users to elevate their privileges by passing __WCLONE|__WALL to the sys_wait4 function.
CVSS v2.0: 7.2
GHSA-jq52-3fww-m362: Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp.
CVSS v3.1: 6.1
GHSA-5vcq-xrm9-g6mr: The TIFF decoder in ImageMagick before 6.0 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.
RHSA-2024:7977: Red Hat Security Advisory: firefox security update
firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill)
CVSS v3.1: 9.8
CVE-2008-5879: Cross-site scripting (XSS) vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors.
CVSS v2.0: 4.3
CVE-2021-39183: Unsafe inline XSS Owncast
Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.
CVSS v3.1: 8.2
CVE-2023-2079: Buy Me a Coffee – Button and Widget Plugin <= 3.7 - Cross-Site Request Forgery
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for unauthenticated attackers to update the plugins settings, via a forged request granted the attacker can trick a site's administrator into performing an action such as clicking on a link.
CVSS v3.1: 7.1
GHSA-7pmw-j64m-whv3: Cross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to inject arbitrary web script or HTML via the dsname parameter to happyjuddi.jsp.
CVSS v3.0: 6.1
CVE-2002-1933: The terminal services screensaver for Microsoft Windows 2000 does not automatically lock the terminal window if the window is minimized, which could allow local users to gain access to the terminal server window.
CVSS v2.0: 7.2
CVE-2020-17107: HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
CVSS v3.1: 7.8
GHSA-rf96-324p-x7v8: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8bitkid Yahoo! WebPlayer allows Reflected XSS. This issue affects Yahoo! WebPlayer: from n/a through 2.0.6.
CVSS v3.1: 7.1
GHSA-69mf-2cw2-38m8: Malicious Package in js-shc3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.RecommendationRemove the package from your environment. Ensure no Ethereum funds were compromised.
CVSS v3.1: 9.8
GHSA-v265-mq78-w999: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal IFrame Remove Filter allows Cross-Site Scripting (XSS).This issue affects IFrame Remove Filter: from 0.0.0 before 2.0.5.
CVSS v3.1: 6.1