ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2020-14341: The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timings of these scans, an attacker may glean information about hosts and ports which they do not have access to scan directly.
CVSS v3.1: 2.7
CVSS v2.0: 4
GHSA-4rw9-jwmq-4v5r: An information leak flaw was found due to uninitialized memory in the Linux kernel’s TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user cannot control what is read. This flaw affects the Linux kernel versions prior to 5.17-rc1.
CVSS v3.1: 5.5
CVE-2017-12523: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.
CVSS v3.0: 8.8
CVSS v2.0: 9
RHSA-2020:0567: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 3.8.5 security update
netty: HTTP request smuggling netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling
CVSS v3.1: 7.5
CVE-2020-17408: This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the clpwebmc executable. Due to the improper restriction of XML External Entity (XXE) references, a specially-crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-10801.
CVSS v3.0: 7.5
CVE-2012-2042: Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0780, CVE-2012-2023, CVE-2012-2024, CVE-2012-2025, and CVE-2012-2026.
CVSS v2.0: 10
CVE-2004-1452: Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat, but executes the scripts with root privileges, which could allow local users in the tomcat group to execute arbitrary commands as root by modifying the scripts.
CVSS v2.0: 7.2
CVE-2015-2435: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, and Silverlight before 5.1.40728 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."
CVSS v2.0: 9.3
GHSA-2xmc-f6qc-h4h9: In the Linux kernel, the following vulnerability has been resolved:tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDRIn the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an
uninitialised on-stack struct sockaddr_storage to userspace via
ifr_hwaddr, but netif_get_mac_address() only writes sa_family and
dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a
macvtap chardev returns kernel .text and direct-map pointers, defeating
KASLR.Initialise ss at declaration.
CVE-2019-0191: Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.
CVSS v3.0: 6.5
CVSS v2.0: 4
GHSA-6mwv-rxcm-749p: MIME buffer overflow in Sendmail 8.8.0 and 8.8.1 gives root access.
CVE-2024-33469: An issue in Team Amaze Amaze File Manager v.3.8.5 and fixed in v.3.10 allows a local attacker to execute arbitrary code via the onCreate method of DatabaseViewerActivity.java.
CVSS v3.1: 7.9
CVE-2024-9079: code-projects Student Record System marks.php sql injection
A vulnerability was found in code-projects Student Record System 1.0 and classified as critical. This issue affects some unknown processing of the file /marks.php. The manipulation of the argument coursename leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
GHSA-gffr-5pg9-5cr5: Multiple SQL injection vulnerabilities in Dwc_articles 1.6 and earlier allow remote attackers to execute arbitrary SQL statements.
GHSA-j8j5-m69g-6q3j: Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-hphg-jf8m-wgxp: Out-of-bounds read in parsing textbox object in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory.
CVSS v3.1: 4
GHSA-pwwx-2gvr-j6qv: In PLC WinProladder Version 3.28 and prior, a stack-based buffer overflow vulnerability can be exploited when a valid user opens a specially crafted file, which may allow an attacker to remotely execute arbitrary code.
RHSA-2023:6813: Red Hat Security Advisory: kernel security and bug fix update
kernel: netfilter: NULL pointer dereference in nf_tables due to zeroed list head kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags
CVSS v3.1: 7.8
CVE-2011-5159: Cross-site scripting (XSS) vulnerability in admin/configuration.php in Geeklog before 1.7.1sr1 allows remote attackers to inject arbitrary web script or HTML via the sub_group parameter, a different vulnerability than CVE-2011-4942.
CVSS v2.0: 4.3
CVE-2025-66680: An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files via a crafted request.
CVSS v3.1: 7.1
CVE-2021-21440: Support Bundle includes S/Mime and PGP keys
Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions.
CVSS v3.1: 5.2
CVE-2025-57872: BUG-000174150 - Unvalidated redirect in Portal for ArcGIS.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
CVSS v3.1: 6.1
CVE-2020-12011: A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2018-20949: cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385).
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2020-9968: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.0 and iPadOS 14.0, macOS Catalina 10.15.7, tvOS 14.0, watchOS 7.0. A malicious application may be able to access restricted files.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
RHSA-2019:0717: Red Hat Security Advisory: kernel security and bug fix update
kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members
CVSS v3.0: 4.4
CVE-2023-45849: Arbitrary Code Execution in Helix Core
An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2.  Reported by Jason Geffner.

CVSS v3.1: 9
GHSA-4qmh-g6r8-83mc: Invision Power Board (IPB) before 2.1.6 allows remote attackers to execute arbitrary PHP script via attack vectors involving (1) the post_icon variable in classes/post/class_post.php and (2) the df value in action_public/moderate.php.
GHSA-24r8-jmfh-r268: Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).
CVSS v3.1: 9.8
CVE-2021-20509: IBM Maximo Asset Management 7.6.0 and 7.6.1 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 198243.
CVSS v3.0: 7
RHSA-2026:29796: Red Hat Security Advisory: OpenShift Container Platform 4.22.3 security and extras update
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
CVSS v3.1: 7.5
GHSA-wrwp-h7qf-jwgj: Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of the CGI form parameters.
CVSS v3.1: 8
GHSA-m78g-6w88-h522: A vulnerability classified as critical has been found in Campcodes Online Examination System 1.0. This affects an unknown part of the file addExamExe.php. The manipulation of the argument examTitle leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264447.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-wjpv-frf2-3r58: EC-CUBE Directory traversal vulnerability
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.
CVSS v3.1: 2.7
GHSA-fj7x-q9j7-g6q6: Black vulnerable to Regular Expression Denial of Service (ReDoS)
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
CVSS v3.1: 5.3
GHSA-f4hh-m2gg-974r: In the Linux kernel, the following vulnerability has been resolved:drm/panthor: Flush shmem writes before mapping buffers CPU-uncachedThe shmem layer zeroes out the new pages using cached mappings, and if
we don't CPU-flush we might leave dirty cachelines behind, leading to
potential data leaks and/or asynchronous buffer corruption when dirty
cachelines are evicted.
RHSA-2017:1766: Red Hat Security Advisory: kernel security and bug fix update
kernel: NFSv3 server does not properly handle payload bounds checking of WRITE requests
CVSS v3.0: 6.5
CVE-2008-0578: Cross-site scripting (XSS) vulnerability in the web management login page in Tripwire Enterprise 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
CVE-2016-5882: IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2018-17469: Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-fp78-87mw-cjm6: Multiple unspecified vulnerabilities in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors related to "error checking of system calls."
CVE-2022-3372: Cross-Site Request Forgery (CSRF) in Riello UPS Netman-204
There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical for industrial operations.
CVSS v3.1: 8.8
CVE-2025-14806: IBM Planning Analytics Information Disclosure
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.
CVSS v3.1: 5.7
GHSA-m75p-rvff-x8gj: install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter.
CVSS v3.0: 9.8
GHSA-qr9h-j6xg-2j72: Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
SummaryPossibility to craft a request that will crash the Qwik Server in the default configuration.DetailsWhen a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit.PoCSetup a Qwik Project `pnpm create qwik@latest`Start the Qwik Server using `pnpm run preview`Execute the following curl command to crash the instanceHere the `qfunc` query parameter, `X-Qrl` header and payload need to have the same qrl.The Qwik Server will then crash with the messageThe same can also be repeated running Qwik in production using express.Setup a Qwik Project `pnpm create qwik@latest`Install the express middleware `pnpm run qwik add express`Build the qwik app using `pnpm run build`Start the server using `pnpm run serve`Execute the following curl command to crash the instanceImpactAny Qwik Server instance running the default configuration can be crashed. Using a simple loop to send this HTTP request will cause permanent down time of the service as it takes a few seconds for an instance to restart.There is also the issue that this can happen without a malicious attacker.
When a Qwik Application is deployed through a CDN and an old instance is still loaded on some Client, like through an inactive Tab. Once that user returns to the old Version and performs an action that runs a removed qfunc the server will crash.
CVSS v4.0: 9.2
CVE-2019-5476: An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able to execute arbitrary SQL commands.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-8wx2-v65v-5x9x: IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215592.
GHSA-9px2-pxx2-vq3x: The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues
CVE-2024-50546: WordPress MyOrderDesk plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riley Magnuson MyOrderDesk myorderdesk allows DOM-Based XSS.This issue affects MyOrderDesk: from n/a through <= 3.2.6.
CVSS v3.1: 6.5
CVE-2025-59206: Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
CVSS v3.1: 7.4
GHSA-xg9f-gj9x-f37p: On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the SSL Forward Proxy feature enabled can force the Traffic Management Microkernel (tmm) to leak memory. As a result, system memory usage increases over time, which may eventually cause a decrease in performance or a system reboot due to memory exhaustion.
CVSS v3.0: 7.5
GHSA-75rw-5mh8-g8gf: A potential vulnerability in the SMI callback function in some Lenovo ThinkPad models may allow arbitrary code execution
CVE-2007-3140: SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897.
CVSS v2.0: 6.5
GHSA-7w44-35gq-6jc3: In the Linux kernel, the following vulnerability has been resolved:audit: fix incorrect inheritable capability in CAPSET records__audit_log_capset() records the effective capability set into the
inheritable field due to a copy-paste error. Every CAPSET audit
record therefore reports cap_pi (process inheritable) with the value
of cap_effective instead of cap_inheritable.This silently corrupts audit data used for compliance and forensic
analysis: an attacker who modifies inheritable capabilities to
prepare for a privilege-escalating exec would have the change masked
in the audit trail.The bug has been present since the original introduction of CAPSET
audit records in 2008.
GHSA-q638-6f5m-m527: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Veil veil allows PHP Local File Inclusion.This issue affects Veil: from n/a through <= 1.9.
CVSS v3.1: 8.1
CVE-2008-2938: Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
CVSS v2.0: 4.3
CVE-2010-0236: The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold does not properly allocate memory for the destination key associated with a symbolic-link registry key, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Allocation Vulnerability."
CVSS v2.0: 7.2
GHSA-h8wx-v5rf-mxrf: Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS v3.1: 7.8
CVE-2022-32656: In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN20220705035; Issue ID: GN20220705035.
CVSS v3.1: 6.7
CVE-2024-5453: ProfileGrid <= 5.8.6 - Missing Authorization
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_dismissible_notice and pm_wizard_update_group_icon functions in all versions up to, and including, 5.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options to the value '1' or change group icons.
CVSS v3.1: 4.3
RHSA-2026:26427: Red Hat Security Advisory: kernel security update
kernel: mptcp: fix slab-use-after-free in __inet_lookup_established kernel: Buffer overflow in drivers/xen/sys-hypervisor.c kernel: xen/privcmd: fix double free via VMA splitting kernel: wifi: brcmfmac: validate bsscfg indices in IF events kernel: netfilter: flowtable: strictly check for maximum number of actions kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers kernel: wifi: mac80211: remove station if connection prep fails kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result
CVSS v3.1: 7
CVE-2024-51741: Redis allows denial-of-service due to malformed ACL selectors
Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.
CVSS v3.1: 4.4
CVE-2010-2459: SQL injection vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to execute arbitrary SQL commands via the videoid parameter.
CVSS v2.0: 7.5
CVE-2016-10099: Borg (aka BorgBackup) before 1.0.9 has a flaw in the cryptographic protocol used to authenticate the manifest (list of archives), potentially allowing an attacker to spoof the list of archives.
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2011-0073: Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly use nsTreeRange data structures, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "dangling pointer."
CVSS v2.0: 10
CVE-2024-49990: drm/xe/hdcp: Check GSC structure validity
In the Linux kernel, the following vulnerability has been resolved:

drm/xe/hdcp: Check GSC structure validity

Sometimes xe_gsc is not initialized when checked at HDCP capability
check. Add gsc structure check to avoid null pointer error.
CVSS v3.1: 5.5
CVE-2008-5706: The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/trigger.tmp temporary file.
CVSS v2.0: 6.9
CVE-2026-1660: Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation.
CVSS v3.1: 6.5
CVE-2022-34303: A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.
CVSS v3.1: 6.7
CVE-2025-8712: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.
CVSS v3.1: 5.4