ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-55hg-8qxv-qj4p: PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
SummaryAn unsafe HEEx template generation vulnerability allows any unauthenticated user to execute arbitrary code on the server. The phoenix_storybook playground accepts user-controlled attribute values over WebSocket and interpolates them unsanitized into a HEEx template that is subsequently compiled and evaluated with full Elixir `Kernel` access.DetailsThe vulnerability is a three-step chain:**1. Unsanitized WebSocket input (`extra_assigns_helpers.ex`)**
The `psb-assign` event handler in `PhoenixStorybook.Story.PlaygroundPreviewLive` accepts arbitrary attribute names and values from unauthenticated WebSocket clients and  stores them verbatim via `ExtraAssignsHelpers.handle_set_variation_assign/3`.**2. Unescaped interpolation into HEEx (`component_renderer.ex`)**
`ComponentRenderer.attributes_markup/1` builds a HEEx template string by interpolating binary attribute values directly:No escaping of `"` or `{` is performed. A value such as `foo" injected={EXPR} bar="` breaks out of the attribute string and injects `EXPR` as an inline HEEx expression.**3. Unsandboxed evaluation (`component_renderer.ex`)**
The resulting HEEx string is compiled via `EEx.compile_string/2` and evaluated via `Code.eval_quoted_with_env/3` with full `Kernel` imports and no sandbox. The injected expression executes on the server even if it causes a rendering error.PoCIdentify any story URL with a Playground tab (e.g. `/storybook/core_components/button`).Connect to the Phoenix LiveView WebSocket without any authentication.Join the story's LiveView channel and send a `psb-assign` event with an attribute value that escapes the HEEx attribute context and embeds an Elixir expression (e.g. a `System.cmd/2` call).The server evaluates the injected expression and returns its output in the rendered response.No authentication, no special configuration, and no user interaction are required.ImpactThis is a pre-authentication remote code execution vulnerability. Any user able to reach the storybook endpoint, including unauthenticated internet users if the storybook is publicly deployed, can execute arbitrary operating system commands with the privileges of the server process. All versions of `phoenix_storybook` from 0.5.0 before 1.1.0 are affected.ResourcesIntroduction Commit: https://github.com/phenixdigital/phoenix_storybook/commit/e35379dfe2ef1a71b141899e36f431017c55265dPatch Commit: https://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d
CVSS v4.0: 9.5
CVE-2018-1000134: UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty password when running in synchronous mode. commit with applied fix https://github.com/pingidentity/ldapsdk/commit/8471904a02438c03965d21367890276bc25fa5a6#diff-f6cb23b459be1ec17df1da33760087fd that can result in Ability to impersonate any valid user. This attack appear to be exploitable via Providing valid username and empty password against servers that do not do additional validation as per https://tools.ietf.org/html/rfc4513#section-5.1.1. This vulnerability appears to have been fixed in after commit 8471904a02438c03965d21367890276bc25fa5a6.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2020-3746: Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-p4jm-79g6-hqx3: A Vulnerability in the firmware of COMMAX WallPad(CDP-1020MB) allow an unauthenticated adjacent attacker to execute arbitrary code, because of a using the old version of MySQL.
GHSA-9v83-922f-cpvf: Support Incident Tracker before 3.51, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.
GHSA-4x2c-gqrf-gvf9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpOpal Opal Widgets For Elementor allows Stored XSS.This issue affects Opal Widgets For Elementor: from n/a through 1.6.9.
CVSS v3.1: 6.5
CVE-2019-5383: A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2020-25005: Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to execute arbitrary code.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2023-25881: ZDI-CAN-19390: Adobe Dimension OBJ File Improper Input Validation Remote Code Execution
Adobe Dimension versions 3.4.7 (and earlier) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2022-47543: An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects.
CVSS v3.1: 5.3
GHSA-ppgm-9rrh-gx75: A memory leak vulnerability was found in Privoxy when handling errors.
GHSA-9m6f-7xcq-8vf8: Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
CVSS v3.1: 8.1
CVE-2025-46676: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, LTS 2023 release versions 7.10.1.0 through 7.10.1.70, contain an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS v3.1: 2.7
CVE-2010-4502: Integer overflow in KmxSbx.sys 6.2.0.22 in CA Internet Security Suite Plus 2010 allows local users to cause a denial of service (pool corruption) and execute arbitrary code via crafted arguments to the 0x88000080 IOCTL, which triggers a buffer overflow.
CVSS v2.0: 7.2
CVE-2019-14940: In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent invalid input.
CVSS v3.0: 6.5
CVSS v2.0: 4
GHSA-w6ff-xghx-7936: The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1: 9.8
RHSA-2022:9078: Red Hat Security Advisory: thunderbird security update
Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content Mozilla: Arbitrary file read from a compromised content process Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions Mozilla: Memory safety bugs fixed in Firefox ESR 102.6 and Thunderbird 102.6 Mozilla: Use-after-free in WebGL Mozilla: Memory corruption in WebGL Mozilla: Use-after-free in WebGL
CVSS v3.1: 8.1
CVE-2026-45778: Open XDMoD Vulnerable to Reflected Cross-Site Scripting (XSS) in Password Reset
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, an authenticated attacker can inject malicious JavaScript into their Open XDMoD user profile and abuse the password reset functionality to email a link to an HTML page, which when visited by the victim, reflects and executes the unsanitized payload in the victim's browser, potentially leading to credential capture and Open XDMoD account takeover. All deployments of Open XDMoD prior to 11.0.3 are impacted. This issue was reported privately on 2026-04-06, and at this time there is no evidence that this vulnerability has been exploited in the wild. The vulnerability was patched in Open XDMoD 11.0.3 on 2026-05-12. As a workaround, apply the patch manually.
CVSS v4.0: 8.6
CVE-2006-3327: Cross-site scripting (XSS) vulnerability in Custom dating biz dating script 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) sn20_special_cases parameter ("Special Cases" field) in profile/mini.php, (2) tyxx01_album_name parameter ("Album Name" field) in profile/photo_create.php, and the (3) u parameter in admin/user_view.php.
CVSS v2.0: 4.3
CVE-2024-1183: SSRF Vulnerability in gradio-app/gradio
An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
CVSS v3.0: 6.5
CVE-2021-34735: Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities
Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting in remote code execution or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 8.8
GHSA-7cx6-7887-9rwv: The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.
CVSS v3.0: 5.5
CVE-2024-21308: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2026-5351: Trendnet TEW-657BRM setup.cgi add_wps_client os command injection
A weakness has been identified in Trendnet TEW-657BRM 1.00.1. This affects the function add_wps_client of the file /setup.cgi. This manipulation of the argument wl_enrolee_pin causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-qggv-955f-27x4: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.
CVSS v3.1: 6.5
GHSA-4x4x-4vj8-5xpf: Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality via vectors related to RPC Utility.
GHSA-4rcc-hgj8-2rw6: An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a network.
CVSS v3.1: 9.6
GHSA-mmmw-7m5w-3rc3: Yahei-PHP Prober 0.4.7 contains a remote HTML injection vulnerability that allows attackers to execute arbitrary HTML code through the 'speed' GET parameter. Attackers can inject malicious HTML code in the 'speed' parameter of prober.php to trigger cross-site scripting in user browser sessions.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
GHSA-qf85-wq7g-jwjx: A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin/Config.cgi?action=set of the component Configuration Handler. The manipulation leads to improper authorization. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 4.3
CVE-2024-1503: Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated attackers to deactivate the plugin and erase all data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This requires the "Erase upon uninstallation" option to be enabled.
CVSS v3.1: 4.3
CVE-2022-27632: Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware versions, WATCH BOOT L-zero RPC-M4L [End of Sale] all firmware versions, WATCH BOOT mini RPC-M4H [End of Sale] all firmware versions, WATCH BOOT nino RPC-M2CS firmware version 1.00A to 1.00D, WATCH BOOT light RPC-M5CS firmware version 1.00A to 1.00D, WATCH BOOT L-zero RPC-M4LS firmware version 1.00A to 1.20A, and Signage Rebooter RPC-M4HSi firmware version 1.00A), PoE Rebooter(PoE BOOT nino PoE8M2 firmware version 1.00A to 1.20A), Scheduler(TIME BOOT mini RSC-MT4H [End of Sale] all firmware versions, TIME BOOT RSC-MT8F [End of Sale] all firmware versions, TIME BOOT RSC-MT8FP [End of Sale] all firmware versions, TIME BOOT mini RSC-MT4HS firmware version 1.00A to 1.10A, and TIME BOOT RSC-MT8FS firmware version 1.00A to 1.00E), and Contact Converter(POSE SE10-8A7B1 firmware version 1.00A to 1.20A) allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operations by having a user to view a specially crafted page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2022-3911: iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin
The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc
CVSS v3.1: 8.8
GHSA-43xj-7j8x-m26r: A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown processing of the file /pages/save_user.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure contains confusing vulnerability classes and file names.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2023-33166: Remote Procedure Call Runtime Denial of Service Vulnerability
Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS v3.1: 6.5
CVE-2014-2848: A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain privileges by replacing the dissolvable agent executable in the Windows temp directory with a Trojan horse program.
CVSS v2.0: 6.9
CVE-2022-20787: Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.
CVSS v3.1: 5.7
CVE-2022-35691: Adobe Acrobat Reader NULL Pointer Dereference Application denial-of-service
Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-g8gp-8cc3-6f2w: XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-4706.
CVSS v3.0: 7.5
GHSA-xxf9-rgcc-942c: prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
CVSS v3.1: 8.8
GHSA-3wh5-mq76-rf8p: Object lifecycle issue in WebAssembly in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
GHSA-4jc8-xpvv-r48p: Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsOption[pagetype] parameter to the default URI for modules/news/.  NOTE: this can be leveraged by using legitimate product functionality to upload a file that contains the code, then including that file.
CVE-2023-45146: Remote code execution in XXL-RPC
XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism. When such a configuration is used, attackers may be able to connect to the server and provide malicious serialized objects that, once deserialized, force it to execute arbitrary code. This can be abused to take control of the machine the server is running by way of remote code execution. This issue has not been fixed.
CVSS v3.1: 9.1
CVE-2018-10267: WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-6fjc-2q3r-pj6j: A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionality of SEO Panel version 4.10.0. This makes it possible for remote attackers to scan ports in the local environment.
CVSS v3.1: 5.3
GHSA-xj6v-gwfp-883r: Cross-site scripting (XSS) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0: 6.1
RHSA-2023:1479: Red Hat Security Advisory: firefox security update
nss: Arbitrary memory write via PKCS 12 Mozilla: Incorrect code generation during JIT compilation Mozilla: Potential out-of-bounds when accessing throttled streams Mozilla: Invalid downcast in Worklets Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
CVSS v3.1: 8.8
RHSA-2026:17525: Red Hat Security Advisory: python3.12 security update
python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
CVSS v3.1: 8.1
GHSA-m357-g5r5-9xrx: IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly import jobs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted job.
CVE-2022-36250: Cross Site Request Forgery on Shop Beat Services
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS v3.1: 8.8
RHSA-2017:1108: Red Hat Security Advisory: java-1.8.0-openjdk security and bug fix update
OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520) OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528) OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011) OpenJDK: newline injection in the FTP client (Networking, 8170222) OpenJDK: MD5 allowed for jar verification (Security, 8171121) OpenJDK: newline injection in the SMTP client (Networking, 8171533)
CVSS v3.0: 3.7
GHSA-cm4w-gmjc-w5mw: In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. This could lead to remote code execution in combination with other bugs, with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 8.1
CVE-2018-5520: On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow an administrative user to use the dig utility to gain unauthorized access to file system resources.
CVSS v3.0: 4.4
CVSS v2.0: 3.5
GHSA-g644-679q-jjcf: In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3.
CVSS v3.1: 7.5
GHSA-pv37-78jj-hvqv: A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.
CVSS v3.1: 6.5
GHSA-cw8c-6ffq-p4hh: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that
could cause arbitrary file writes when an unauthenticated user on the web server manipulates file path.
CVSS v4.0: 8.6
CVSS v3.1: 7.2
GHSA-w397-9p2j-6x23: Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
CVSS v3.1: 6.1
GHSA-48gw-crqw-m5r2: Total Commander 6.53 uses weak encryption to store FTP usernames and passwords in WCX_FTP.INI, which allows local users to decrypt the passwords and gain access to FTP servers, as possibly demonstrated by the W32.Gudeb worm.
RHSA-2023:4692: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
python-django: Potential denial-of-service vulnerability in file uploads python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator
CVSS v3.1: 7.5
GHSA-5h2w-44mr-8x27: IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pLanPortRange and pWanPortRange parameters in the formSetPortMapping function.
CVSS v3.1: 9.8
GHSA-j35x-665j-jwcw: The Bunny’s Print CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.95. This is due to missing or incorrect nonce validation on the pcss_options_subpanel() function. This makes it possible for unauthenticated attackers to update settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3