ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-49732: In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
CVE-2013-2003: Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the _XcursorFileHeaderCreate function.
CVSS v2.0: 6.8
GHSA-hpww-gcq4-rc3c: A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.
CVSS v3.1: 9.6
GHSA-wmpm-5g3x-2hjj: Directory traversal vulnerability in the set_log_config function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname.
CVE-2008-1703: Multiple buffer overflows in TIBCO Software Rendezvous before 8.1.0, as used in multiple TIBCO products, allow remote attackers to execute arbitrary code via a crafted message.
CVSS v2.0: 9.3
CVE-2025-53886: Directus doesn't redact tokens in Flow logs
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow. Version 11.9.0 fixes the issue.
CVSS v3.1: 4.5
GHSA-h2fg-54x9-5qhq: Nil dereference in NATS JWT, DoS of nats-server
Problem DescriptionThe NATS account system has an Operator trusted by the servers, which signs Accounts, and each Account can then create and sign Users within their account.  The Operator should be able to safely issue Accounts to other entities which it does not fully trust.A malicious Account could create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library (written in Go) would attempt a nil dereference, aborting execution.The NATS Server is known to be impacted by this.Affected versionsJWT libraryall versions prior to 1.1.0NATS ServerVersion 2 prior to 2.1.9ImpactJWT libraryPrograms would nil dereference and panic, aborting execution by default.NATS serverDenial of Service caused by process terminationWorkaroundIf your NATS servers do not trust any accounts which are managed by untrusted entities, then malformed User credentials are unlikely to be encountered.SolutionUpgrade the JWT dependency in any application using it.Upgrade the NATS server if using NATS Accounts.
CVSS v3.1: 7.5
CVE-2023-47259: Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter.
CVSS v3.1: 6.1
CVE-2025-8983: itsourcecode Online Tour and Travel Management System expense.php sql injection
A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/expense.php. The manipulation of the argument expense_for leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2022-33250: Reachable assertion in Modem
Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.
CVSS v3.1: 7.5
GHSA-5qmr-54g6-4256: University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.
CVSS v3.1: 7.5
CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue
In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: fix potential unbounded skb queue

virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.

virtio_transport_recv_enqueue() skips coalescing for packets
with VIRTIO_VSOCK_SEQ_EOM.

If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM,
a very large number of packets can be queued
because vvs->rx_bytes stays at 0.

Fix this by estimating the skb metadata size:

	(Number of skbs in the queue) * SKB_TRUESIZE(0)
CVSS v3.1: 7.1
GHSA-wvfj-6r8w-h76p: Transient DOS while handling beacon frames with invalid IE header length.
CVSS v3.1: 7.5
CVE-2021-24104: Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
CVSS v3.1: 4.6
GHSA-m3wp-9jj9-qqp4: All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.
GHSA-p53g-v548-5w7v: The DPA countermeasures on Silicon Labs' Series 2 devices are not reseeded periodically as they should be. This may allow an attacker to eventually extract secret keys through a DPA attack.
CVSS v3.1: 4.2
GHSA-r3c7-v6q7-j6rm: A heap-buffer-overflow had occurred in function gf_isom_dovi_config_get of isomedia/avc_ext.c:2490, as demonstrated by MP4Box. This vulnerability was fixed in commit fef6242.
CVSS v3.1: 5.5
GHSA-r3ww-6w46-7xwj: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS v3.1: 6.3
CVE-2025-43275: A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to break out of its sandbox.
CVSS v3.1: 9.8
GHSA-2xv7-55qq-fqg6: Local Security Authority (LSA) Elevation of Privilege Vulnerability.
CVSS v3.1: 7.8
GHSA-55r4-4mfh-f69q: Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via unknown vectors related to Web Services.
CVE-2024-21386: .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
CVSS v3.1: 7.5
RHSA-2024:6016: Red Hat Security Advisory: OpenShift Container Platform 4.15.30 packages and security update
python-werkzeug: user may execute code on a developer's machine
CVSS v3.1: 7.5
GHSA-vjjh-2vw8-2qx2: Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally.
CVSS v3.1: 5.5
GHSA-49mx-v59p-m55m: A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.
CVSS v3.0: 9.9
CVE-2007-5797: SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
CVSS v2.0: 7.5
GHSA-49p4-3jx5-xgmj: The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.
GHSA-r2px-4gvw-fv96: Cross-site request forgery (CSRF) vulnerability in index.php in WoltLab Burning Board Lite (wBB) 2 Beta 1 allows remote attackers to delete threads as other users via the ThreadDelete action.
CVE-2003-0144: Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3, OpenBSD 3.2 and earlier, and possibly other operating systems, allows local users to gain root privileges via long command line arguments such as (1) request ID or (2) user name.
CVSS v2.0: 7.2
GHSA-cqh3-qq3j-3gjm: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the log_upload binary.
CVSS v3.1: 9.8
GHSA-q6j5-fjx5-2mc3: pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field
Summarypnpm's tarball extraction worker skips integrity verification when the `integrity` field is absent from the lockfile resolution. If an attacker can both modify `pnpm-lock.yaml` to remove the `integrity:` field and cause the referenced registry URL to serve altered package content, `pnpm install --frozen-lockfile` can install the altered package without an integrity error. npm's `npm ci` enforces integrity by default; pnpm's behavior of silently skipping verification is a pnpm-specific fail-open gap.Vulnerability DetailsThe `addTarballToStore` function in `worker/src/start.ts` (lines 189-204) checks `if (integrity)` before verifying the tarball hash. The `TarballResolution` type declares `integrity` as optional (`integrity?: string`). When the lockfile omits the `integrity` field, the guard evaluates to `false`, skipping hash verification entirely. The worker then computes a new hash from the unverified content and stores it as legitimate.Proof of ConceptImpactSupply chain compromise in environments where an attacker can both alter the lockfile and cause the referenced registry URL to serve altered package content. The `--frozen-lockfile` flag does not fail closed when the integrity field is missing.Suggested RemediationRequire an `integrity` field for remote tarball resolutions. Change the `if (integrity)` guard to fail when integrity is absent for non-local packages. When `--frozen-lockfile` is active, reject lockfile entries that lack integrity for remote packages.Discovered by [AutoFyn](https://github.com/SignalPilot-Labs/AutoFyn)
Full audit report: [audit_report.md](https://github.com/tempcollab/pnpm/blob/main/autofyn_audit/audit_report.md)
Exploit script: [exploit.sh](https://github.com/tempcollab/pnpm/blob/main/autofyn_audit/exploits/vuln1_integrity_bypass/exploit.sh)
CVSS v3.1: 6.8
CVE-2019-11868: See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying any kernel address to which arbitrary bytes are written to.
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-c58j-fj65-hr85: SQL injection vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.
GHSA-4jrw-64vr-7g8m: Apache Camel camel-neo4j component is vulnerable to cypher injection
Cypher Injection vulnerability in Apache Camel camel-neo4j component.This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.
CVSS v4.0: 6.9
GHSA-r4hm-9crw-6g4m: In the Linux kernel, the following vulnerability has been resolved:batman-adv: avoid OGM aggregation when skb tailroom is insufficientWhen OGM aggregation state is toggled at runtime, an existing forwarded
packet may have been allocated with only packet_len bytes, while a later
packet can still be selected for aggregation. Appending in this case can
hit skb_put overflow conditions.Reject aggregation when the target skb tailroom cannot accommodate the new
packet. The caller then falls back to creating a new forward packet
instead of appending.
CVSS v3.1: 7.8
GHSA-pwcr-rqrx-fj4m: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS v3.1: 7.8
CVE-2008-3533: Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
CVSS v2.0: 10
CVE-2022-45966: here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.
CVSS v3.1: 9.8
CVE-2006-7099: Directory traversal vulnerability in index.php in SolarPay allows remote attackers to read certain files via a .. (dot dot) in the read parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 5
GHSA-hpv9-qcm6-xpww: Cross-site scripting (XSS) vulnerability in MPM Guestbook 1.2 allows remote attackers to inject arbitrary web script or HTML via the lng parameter.
GHSA-rg4v-3x6j-q8rr: Ashop Shopping Cart Software contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'shop' parameter. Attackers can send GET requests to index.php with malicious 'shop' values using UNION-based SQL injection to extract sensitive database information.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
GHSA-jg22-m6v9-7rwj: Associated Press (AP) Newspower 4.0.1 and earlier uses a default blank password for the MySQL root account, which allows remote attackers to insert or modify news articles via shows.tblscript.
GHSA-m593-pjhp-f33p: A vulnerability was found in VMSMan up to 20250416. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Email with the input "><script>alert(1)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVE-2007-3373: daemon.c in cman (redhat-cluster-suite) before 20070622 does not clear a buffer for reading requests, which might allow local users to obtain sensitive information from previous requests.
CVSS v2.0: 5
CVE-2017-5578: Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
CVSS v3.1: 6.5
CVSS v2.0: 4.9
CVE-2025-6606: SourceCodester Best Salon Management System add-services.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. This issue affects some unknown processing of the file /panel/add-services.php. The manipulation of the argument Type leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-3855-fjjh-9xh2: A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users.This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.
CVSS v3.1: 5.4
GHSA-pfpc-c982-xg3q: The FiWin SS28S WiFi VoIP SIP/Skype Phone, firmware version 01_02_07, has a hard-coded username and password, which allows remote attackers to gain administrative access via telnet.
GHSA-mr39-8q83-8vfh: TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability, allowing attackers to delete arbitrary files on the user's system.
CVSS v4.0: 7
CVSS v3.1: 8.1
GHSA-ggwr-xqfc-8r6r: Cross-Site Request Forgery (CSRF) vulnerability in Tradebooster Video XML Sitemap Generator.This issue affects Video XML Sitemap Generator: from n/a through 1.0.0.
CVSS v3.1: 4.3
GHSA-c8j7-qh9h-9m9g: A security vulnerability has been detected in UTT 进取 512W 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goform/formConfigCliForEngineerOnly. Such manipulation of the argument addCommand leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
CVE-2023-20637: In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628588; Issue ID: ALPS07628588.
CVSS v3.1: 6.7
RHSA-2026:2783: Red Hat Security Advisory: nodejs:20 security update
nodejs: Nodejs file permissions bypass nodejs: Nodejs uninitialized memory exposure nodejs: Nodejs filesystem permissions bypass nodejs: Nodejs denial of service nodejs: Nodejs denial of service nodejs: Nodejs denial of service
CVSS v3.1: 5.9
CVSS v3.0: 5.3
GHSA-h4hx-g865-m72c: SQL injection vulnerability in albums.php in Ampache before 3.3.3.5 allows remote attackers to execute arbitrary SQL commands via the match parameter.  NOTE: some details are obtained from third party information.
GHSA-9rhv-wh54-fxjm: Improper Control of Generation of Code ('Code Injection') vulnerability in TienCOP WP EXtra.This issue affects WP EXtra: from n/a through 6.2.
CVSS v3.1: 9.9
GHSA-hq2h-9mc3-h6w2: Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name
Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job’s display name shown as part of a build cause.This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.Pipeline Maven Integration Plugin 3.9.3 escapes upstream job names in build causes.
CVSS v3.1: 8
CVE-2023-31330: An out-of-bounds read in the ASP could allow a privileged attacker with access to a malicious bootloader to potentially read sensitive memory resulting in loss of confidentiality.
CVSS v3.1: 2.5
CVE-2016-6425: Cross-site scripting (XSS) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCuy75020 and CSCuy81652.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-fv2j-x4xv-c6qc: Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.
CVSS v3.0: 4.8
CVE-2004-1565: list.php in w-Agora 4.1.6a allows remote attackers to reveal the full path via a crafted HTTP request, possibly involving a malformed id parameter.
CVSS v2.0: 5
GHSA-v2xm-98f2-h7c8: IBM Flex System Manager (FSM) 1.1 through 1.3 before 1.3.2.0 allows remote attackers to enumerate user accounts via unspecified vectors.
GHSA-2qw9-4w7h-8c4q: A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS v3.1: 8.8
RHSA-2014:1876: Red Hat Security Advisory: java-1.7.0-ibm security update
JDK: privilege escalation via shared class cache SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment) OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: insufficient permission checks when setting resource bundle on system logger (Libraries, 8041564) ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540) OpenJDK: DatagramSocket connected socket missing source check (Libraries, 8039509) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment) OpenJDK: insufficient ResourceBundle name check (Libraries, 8044274) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: CipherInputStream incorrect exception handling (Security, 8037846)
CVE-2022-26318: On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2012-4326: Cross-site request forgery (CSRF) vulnerability in commonsettings.php in AlstraSoft Site Uptime Enterprise, possibly 5.4, allows remote attackers to hijack the authentication of administrators.
CVSS v2.0: 6.8
CVE-2025-45863: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the macstr parameter in the formMapDelDevice interface.
CVSS v3.1: 9.8
GHSA-xwvf-75x5-65j6: The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.5.20. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions.
CVSS v3.1: 8.1
GHSA-vg4q-xv5r-w2xc: The mintToken function of a smart contract implementation for CardToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
GHSA-4qw4-h59m-w45h: Directory traversal vulnerability in admin/filebrowser.asp in A-shop 0.70 and earlier, and possibly 0.71, allows remote attackers to delete arbitrary files via unspecified filename references in the delfiles parameter.
GHSA-g546-hwvj-2x8v: Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions.
CVSS v3.1: 9.3