ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-58839: WordPress eDS Responsive Menu Plugin <= 1.2 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Object Injection.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
CVSS v3.1: 7.2
CVE-2024-8367: HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection
A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component Markdown Handler. The manipulation leads to injection. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as d90230d7cf575e5b0852d56660104c8bd2503c34. It is recommended to apply a patch to fix this issue.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 2.7
GHSA-vhpp-73wq-mgfq: IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle timeout. IBM X-Force ID: 208341.
CVSS v3.1: 9.8
CVE-2023-28587: Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
CVSS v3.1: 7.8
GHSA-cv25-3pxr-4q7x: Magento Open Source Security Advisory: Patch SUPEE-10975
Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and more. The following issues have been identified and remediated:PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authenticationMAG-23: M1 Credit Card Storage CapabilityPRODSECBUG-2149: Authenticated RCE using customer importPRODSECBUG-2159: API Based RCE VulnerabilityPRODSECBUG-2156: RCE Via Unauthorized UploadPRODSECBUG-2155: Authenticated RCE using dataflowPRODSECBUG-2053: Prevents XSS in Newsletter TemplatePRODSECBUG-2142: XSS in CMS PreviewPRODSECBUG-1860: Admin Account XSS Attack Cessation via FilenamePRODSECBUG-2119: EE Patch to include names in templatesPRODSECBUG-2129: XSS in Google Analytics VulnerabilityPRODSECBUG-2019: Merchant Wishlist Security StrengtheningPRODSECBUG-2104: Send to a Friend VulnerabilityPRODSECBUG-2125: CSRF on deletion of Blocks VulnerabilityPRODSECBUG-2088: CSRF Vulnerability related to Customer Group DeletionPRODSECBUG-2140: CSRF on deletion of Site MapPRODSECBUG-2108: Outdated jQuery causing PCI scanning failuresMAG-12, MAG-2: Encryption Keys Stored in Plain TextPRODSECBUG-2141: Unauthorized Admin Panel BypassPatching and Upgrading:Patches and upgrades are available for the following Magento versions:Magento Commerce 1.9.0.0-1.14.4.0: Apply SUPEE-10975 or upgrade to Magento Commerce 1.14.4.0.
Magento Open Source 1.5.0.0-1.9.4.0: Apply SUPEE-10975 or upgrade to Magento Open Source 1.9.4.0.
CVE-2007-0007: gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.
CVSS v2.0: 3.6
GHSA-9qh2-6fxg-9m4g: Open Chinese Convert subject to Denial of Service via Out-of-bounds Read
Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.
CVSS v3.0: 5.5
GHSA-x6p3-m6h9-fx7r: n8n: Microsoft SQL Node Prototype Pollution
ImpactAn authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes `Object.prototype` process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rendering the n8n instance completely non-functional until restarted.PatchesThe issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later to remediate the vulnerability.WorkaroundsIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:Limit workflow creation and editing permissions to fully trusted users only.Disable the Microsoft SQL node by adding `n8n-nodes-base.microsoftSql` to the `NODES_EXCLUDE` environment variable.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
CVSS v4.0: 7.2
CVSS v3.1: 8.5
GHSA-5c9j-ww8r-hqmg: Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.
GHSA-j2f2-fp4q-v86p: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.
CVSS v3.1: 7.5
ICSA-17-355-02: Schneider Electric Pelco VideoXpert Enterprise
By sniffing communications, an unauthorized person can execute a directory traversal attack resulting in authentication bypass or session hijack.CVE-2017-9964 has been assigned to this vulnerability. A CVSS v3 base score of 6.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N). Using a directory traversal attack, an unauthorized person can view web server files.CVE-2017-9965 has been assigned to this vulnerability. A CVSS v3 base score of 5.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). By replacing certain files, an authorized user can obtain system privileges and the inserted code would execute at an elevated privilege level.CVE-2017-9966 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVSS v3.0: 7.1
GHSA-wfwm-vf76-3692: Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
CVSS v3.0: 9.8
RHSA-2023:6207: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.6 release and security update
tomcat: improper cleaning of recycled objects could lead to information leak tomcat: incorrectly parsed http trailer headers can cause request smuggling
CVSS v3.1: 5.3
GHSA-5ggr-2fgq-wj6h: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system termination or write kernel memory
CVSS v3.1: 7.1
CVE-2024-34695: WOWS Karma vulnerable to a post submission bounce/timing attack
WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1.
CVSS v3.1: 6.3
GHSA-jw75-49hr-wcmr: There is an Identity spoofing and authentication bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2006-3517: PHP remote file inclusion vulnerability in stats.php in RW::Download, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
CVSS v2.0: 7.5
CVE-2013-0525: Multiple cross-site scripting (XSS) vulnerabilities in IBM iNotes 8.5.x allow local users to inject arbitrary web script or HTML via a shared mail file, aka SPR DKEN8PDNTX.
CVSS v2.0: 1.5
GHSA-jq67-2wg6-5wgp: A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which could let a local malicious user execute arbitrary code.
GHSA-5346-4j79-hf8j: A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server.
CVSS v3.1: 8.8
GHSA-p3x5-jh87-q2jc: Directory traversal vulnerability in Nudester 1.10 and earlier allows remote attackers to read or write arbitrary files via a .. (dot dot) in the CD (CWD) command.
CVE-2022-29106: Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability
Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability
CVSS v3.1: 7
CVE-2015-9443: The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-m5j5-r43x-p3hr: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huurkalender Huurkalender WP allows Stored XSS.This issue affects Huurkalender WP: from n/a through 1.5.6.
CVSS v3.1: 6.5
GHSA-xxhr-8f54-6m66: Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.
CVSS v3.1: 7.5
CVE-2025-10464: Cleartext password storage in Birtech Information Technologies' Sensaway
Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data.

This issue affects Senseway: through 09022026.



NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.
CVSS v3.1: 6.5
CVE-2017-12069: An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 (All versions V8.1 and earlier), SIMATIC WinCC (All versions < V7.4 SP1), SIMATIC WinCC Runtime Professional (All versions < V14 SP1), SIMATIC NET PC Software, and SIMATIC IT Production Suite. By sending specially crafted packets to the OPC Discovery Server at port 4840/tcp, an attacker might cause the system to access various resources chosen by the attacker.
CVSS v3.0: 8.2
CVSS v2.0: 6.4
GHSA-v6gq-6928-vx8w: The Order Export for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.24 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain exported order information. The plugin is only vulnerable when 'Order data storage' is set to 'WordPress posts storage (legacy)', and cannot be exploited when the default option of 'High-performance order storage' is enabled.
CVSS v3.1: 5.9
GHSA-7mxf-3gj9-r25x: PRSD detection denial of service
CVSS v3.1: 3.7
CVE-2024-4619: Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘hover_animation’ parameter in versions up to, and including, 3.21.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2026-7536: Open5GS BSF pcfBindings bsf_sess_add_by_ip_address denial of service
A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function bsf_sess_add_by_ip_address of the file /nbsf-management/v1/pcfBindings of the component BSF. Executing a manipulation of the argument ipv4Addr can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-65rc-5f67-pccj: The Rich Snippet Site Report plugin for WordPress is vulnerable to  SQL Injection via the 'last' parameter in all versions up to, and including, 2.0.0105 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can also be exploited via CSRF.
CVSS v3.1: 4.9
GHSA-25gv-jrjg-43pj: A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-fpm5-vv97-jfwg: Uncontrolled Resource Consumption in firebase
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
CVSS v3.1: 5.3
CVE-2024-20091: In vdec, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09028313; Issue ID: MSV-1701.
CVSS v3.1: 4.4
CVE-2025-21810: driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()
In the Linux kernel, the following vulnerability has been resolved:

driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()

There are a potential wild pointer dereferences issue regarding APIs
class_dev_iter_(init|next|exit)(), as explained by below typical usage:

// All members of @iter are wild pointers.
struct class_dev_iter iter;

// class_dev_iter_init(@iter, @class, ...) checks parameter @class for
// potential class_to_subsys() error, and it returns void type and does
// not initialize its output parameter @iter, so caller can not detect
// the error and continues to invoke class_dev_iter_next(@iter) even if
// @iter still contains wild pointers.
class_dev_iter_init(&iter, ...);

// Dereference these wild pointers in @iter here once suffer the error.
while (dev = class_dev_iter_next(&iter)) { ... };

// Also dereference these wild pointers here.
class_dev_iter_exit(&iter);

Actually, all callers of these APIs have such usage pattern in kernel tree.
Fix by:
- Initialize output parameter @iter by memset() in class_dev_iter_init()
  and give callers prompt by pr_crit() for the error.
- Check if @iter is valid in class_dev_iter_next().
CVSS v3.1: 5.5
GHSA-5cwr-q4qx-8pjg: PHP remote file inclusion vulnerability in akarru.gui/main_content.php in Akarru Social BookMarking Engine 0.4.3.34 and earlier, and possibly 0.4.4.120, allows remote attackers to execute arbitrary PHP code via a URL in the bm_content parameter.
GHSA-qxhm-3vp2-fcq3: Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier. If this vulnerability is exploited, the product may be affected by some known TLS1.0 and TLS1.1 vulnerabilities. As for the specific products/models/versions of MFPs and printers that contain JavaTM Platform, see the information provided by the vendor.
CVSS v3.1: 7.5
GHSA-x626-c49h-fr9m: Archive, check and export commands in Chef InSpec
prior to 4.56.58 and 5.22.29 allow local command execution via maliciously
crafted profile.
CVSS v3.1: 8.8
GHSA-w595-w6qf-w9r3: SQL injection vulnerability in _phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka the login name).
GHSA-x267-8p4f-834v: Microsoft Office Remote Code Execution Vulnerability
CVSS v3.1: 7.8
CVE-2021-31555: An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarc_version (aka oauth_registered_consumer.oarc_version) parameter's length.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2022-43849: IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd kernel extension to cause a denial of service.  IBM X-Force ID:  239170.
CVSS v3.1: 6.2
CVE-2022-0619: Database Peek <= 1.2 - Reflected Cross-Site Scripting
The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-hh5r-8mxw-p8h8: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request.
CVSS v3.1: 7.2
CVE-2022-41844: An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 and CVE-2019-16088.
CVSS v3.1: 5.5
GHSA-r6f6-xhwq-cgg9: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492.
GHSA-m48p-p8gp-9jxf: In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.
CVSS v3.1: 4.3
GHSA-qrxc-f2m6-rvqg: PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.
RHSA-2023:6569: Red Hat Security Advisory: sysstat security and bug fix update
sysstat: check_overflow() function can work incorrectly that lead to an overflow
CVSS v3.1: 7
GHSA-5464-6c37-jhrh: Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0: 6.1
CVE-2021-46279: Session Fixation and Insufficient Session Expiration
Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
CVSS v3.1: 5.8
CVE-2018-15704: Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability by sending a crafted HTTP request to broadweb/system/opcImg.asp.
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2012-0465: Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inbound_proxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication requests with (1) different IP address strings in this header or (2) a long string in this header.
CVSS v2.0: 4.3
GHSA-xxgj-ggp4-xvhw: In the Linux kernel, the following vulnerability has been resolved:clk: zynq: Prevent null pointer dereference caused by kmalloc failureThe kmalloc() in zynq_clk_setup() will return null if the
physical memory has run out. As a result, if we use snprintf()
to write data to the null address, the null pointer dereference
bug will happen.This patch uses a stack variable to replace the kmalloc().
CVSS v3.1: 5.5
GHSA-6gch-px86-w664: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Lasa allows PHP Local File Inclusion. This issue affects Lasa: from n/a through 1.1.
CVSS v3.1: 8.1
CVE-2025-14395: Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions
The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions (e.g., pop_submit, poptheme_submit) in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings and content.
CVSS v3.1: 4.3
CVE-2013-2733: Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2730.
CVSS v2.0: 10
GHSA-2hxc-5mh2-9rxg: A vulnerability in the IPv6 packet processing engine of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient validation of incoming IPv6 traffic. An attacker could exploit this vulnerability by sending a crafted IPv6 packet through an affected device. A successful exploit could allow the attacker to cause an unexpected reboot of the switch, leading to a DoS condition. This vulnerability is specific to IPv6 traffic. IPv4 traffic is not affected.
CVE-2016-9136: Artifex Software, Inc. MuJS before a0ceaf5050faf419401fe1b83acfa950ec8a8a89 allows context-dependent attackers to obtain sensitive information by using the "crafted JavaScript" approach, related to a "Buffer Over-read" issue.
CVSS v3.1: 7.5
CVSS v2.0: 5
RHSA-2025:19426: Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (NVIDIA)
cpython: Cpython infinite loop when parsing a tarfile setuptools: Path Traversal Vulnerability in setuptools PackageIndex vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests xgrammar: XGrammar affected by Denial of Service by infinite recursion grammars
CVSS v3.1: 7.5
GHSA-cwch-jfrm-2v7r: An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Zimbra Briefcase feature due to insufficient sanitization of specific uploaded file types. When a user opens a publicly shared Briefcase file containing malicious scripts, the embedded JavaScript executes in the context of the user's session. This allows an attacker to run arbitrary scripts, potentially leading to data exfiltration or other unauthorized actions on behalf of the victim user.
CVSS v3.1: 6.1
GHSA-45f6-6g3x-67c2: A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/group/edit.do of the component Group Edit Page. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 4.8
CVSS v3.1: 2.4