ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-mh82-x7hm-w8rm: The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation/deactivation due to missing capability checks on the pieregister_install_addon, pieregister_activate_addon and pieregister_deactivate_addon functions in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install, activate and deactivate arbitrary plugins. As a result attackers might achieve code execution on the targeted server
CVSS v3.1: 8.8
GHSA-73h5-69j6-pq7f: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alessandro Staniscia EndomondoWP allows Stored XSS.This issue affects EndomondoWP: from n/a through 0.1.1.
CVSS v3.1: 6.5
CVE-2026-33750: brace-expansion: Zero-step sequence causes process hang and memory exhaustion
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.
CVSS v3.1: 6.5
CVE-2017-14926: In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-8wqw-72q7-h4q9: ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.
GHSA-6859-2qxq-ffv2: pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
CVSS v3.1: 7.9
GHSA-w622-2pcj-f3x2: cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.
CVSS v3.0: 6.5
CVE-2007-2803: SQL injection vulnerability in default.asp in Vizayn Urun Tanitim Sitesi 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a haberdetay action.
CVSS v2.0: 7.5
GHSA-7hj8-8pm2-g3w2: The dpcm_decode_frame function in dpcm.c in libavcodec in FFmpeg before 0.10 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted stereo stream in a media file.
GHSA-chvr-56gh-gq34: A vulnerability has been identified in Opcenter Intelligence (All versions < V2501). Personal access token disclosure vulnerability in Tableau Server. For details go to help.salesforce.com and search for knowledge article id 000390611.
CVSS v3.1: 4.9
CVE-2011-1906: Trustwave WebDefend Enterprise before 5.0 7.01.903-1.4 stores specific user-account credentials in a MySQL database, which makes it easier for remote attackers to read the event collection table via requests to the management port, a different vulnerability than CVE-2011-0756.
CVSS v2.0: 5
GHSA-v62x-q79c-hw4w: A vulnerability classified as critical has been found in itsourcecode Project Expense Monitoring System 1.0. This affects an unknown part of the file transferred_report.php. The manipulation of the argument start/end/employee leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-522g-8fxg-x6c3: mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1 allows guest OS users to determine the existence of host OS files and directories via unspecified vectors.
GHSA-9x3m-mrh3-f5j7: paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) auth.php, (2) login.php, (3) category.php, (4) file.php, (5) team.php, (6) license.php, (7) custom.php, (8) admins.php, or (9) backupdb.php, which reveal the path in a PHP error message.
GHSA-9xgp-hfw7-73rq: Authentication Weakness in keystone
There is an authentication weakness vulnerability in keystone before version 0.3.16.  Due to a bug in the the default sign in functionality, incomplete email addresses could be matched. A correct password is still required to complete sign in.
CVE-2026-25865: Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll Control_RunDLL input.dll. Attackers can place a malicious executable earlier in the search order to achieve arbitrary code execution in the context of the affected user.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
RHSA-2013:0258: Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 security update
apache-cxf: SOAPAction spoofing on document literal web services apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor
GHSA-vxjg-hchx-cc4g: @simonsmith/cypress-image-snapshothas fix for insecure snapshot file names
ImpactIt's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. Example:The above will create an `ignore-relative-dirs.png` three levels upPatchesFixed in `8.0.2`WorkaroundsValidate all the existing uses of `matchImageSnapshot` to ensure correct use of the filename argument. Example:Referenceshttps://github.com/simonsmith/cypress-image-snapshot/issues/15
CVSS v3.1: 6.5
GHSA-r384-9q9m-w3m5: A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest operating system.To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application.The security update addresses the vulnerability by resolving the conditions where Hyper-V would fail to handle these requests., aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2020-0904.
CVSS v3.1: 6.5
GHSA-8m66-492w-vpv3: A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. This affects the function formSetPortTr of the file /goform/formSetPortTr. Performing a manipulation of the argument special_name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2016-9202: A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) Switches could allow an unauthenticated, remote attacker to conduct a persistent cross-site scripting (XSS) attack against a user of the affected interface on an affected device. More Information: CSCvb37346. Known Affected Releases: 9.1.1-036 9.7.1-066.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-9wh9-2m7m-52vq: QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection on the application and obtain Helpdesk application information. A remote attacker does not require any privileges to successfully execute this attack.
CVSS v3.0: 7.5
CVE-2026-28863: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to fingerprint the user.
CVSS v3.1: 6.5
GHSA-6q7v-49c4-hj5m: In the Linux kernel, the following vulnerability has been resolved:apparmor: fix reference count leak in aa_pivotroot()The aa_pivotroot() function has a reference counting bug in a specific
path. When aa_replace_current_label() returns on success, the function
forgets to decrement the reference count of “target”, which is
increased earlier by build_pivotroot(), causing a reference leak.Fix it by decreasing the refcount of “target” in that path.
CVSS v3.1: 5.5
GHSA-q56q-qm7c-m966: HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.188(C00E74R3P8) have an improper authorization vulnerability. The software does not properly restrict certain user's modification of certain configuration file, successful exploit could allow the attacker to bypass app lock after a series of operation in ADB mode.
CVE-2012-0869: Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS v2.0: 4.3
GHSA-fjcx-qrhr-v7rr: The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_image_upload' function in all versions up to, and including, 1.8.89. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1: 9.8
RHBA-2019:3416: Red Hat Bug Fix Advisory: pki-core:10.6 and pki-deps:10:6 bug fix and enhancement update
jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.
CVSS v3.0: 7.5
CVE-2006-1456: Buffer overflow in QuickTime Streaming Server in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via a crafted RTSP request, which is not properly handled during message logging.
CVSS v2.0: 7.5
CVE-2017-16805: In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file, related to r_bin_dwarf_parse_comp_unit in dwarf.c and sdb_set_internal in shlr/sdb/src/sdb.c.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
GHSA-v656-w32r-m2jg: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the wifiOff parameter in the sub_4232EC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS v3.1: 7.5
CVE-2021-35042: Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2025-62410: --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom
In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.
CVSS v4.0: 9.4
GHSA-qj7c-f3xj-jxpv: Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an authoritative server must return large NS sets or address sets.
CVSS v3.1: 7.5
GHSA-cj5p-q86q-6fph: In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-244154558
CVSS v3.1: 7.8
GHSA-v346-9qx9-79fj: An exploitable heap overflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. The string lengths are handled incorrectly when parsing character strings in mDNS resource records, leading to arbitrary code execution in the context of the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability.
CVSS v3.0: 9.8
CVE-2025-53417: File Parsing Deserialization of Untrusted Data in DTM Soft
DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability
CVSS v4.0: 9.3
CVE-2022-26940: Remote Desktop Protocol Client Information Disclosure Vulnerability
Remote Desktop Protocol Client Information Disclosure Vulnerability
CVSS v3.1: 6.5
RHSA-2016:0070: Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.1.1 bug fix and enhancement update
commons-fileupload: Arbitrary file upload via deserialization stapler-adjunct-zeroclipboard: multiple cross-site scripting (XSS) flaws jenkins: denial of service (SECURITY-87) jenkins: username discovery (SECURITY-110) jenkins: job configuration issues (SECURITY-127, SECURITY-128) jenkins: directory traversal flaw (SECURITY-131) jenkins: remote code execution flaw (SECURITY-150) jenkins: plug-in code can be downloaded by anyone with read access (SECURITY-155) jenkins: password exposure in DOM (SECURITY-138) jenkins: cross-site scripting flaw in Jenkins core (SECURITY-143) jenkins: Combination filter Groovy script unsecured (SECURITY-125) jenkins: directory traversal from artifacts via symlink (SECURITY-162) jenkins: update center metadata retrieval DoS attack (SECURITY-163) jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166) jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177) jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177) jenkins: forced API token change (SECURITY-180) jenkins: Project name disclosure via fingerprints (SECURITY-153) jenkins: Public value used for CSRF protection salt (SECURITY-169) jenkins: XXE injection into job configurations via CLI (SECURITY-173) jenkins: Secret key not verified when connecting a slave (SECURITY-184) jenkins: Information disclosure via sidepanel (SECURITY-192) jenkins: Local file inclusion vulnerability (SECURITY-195) jenkins: API tokens of other users available to admins (SECURITY-200) jenkins: Queue API did show items not visible to the current user (SECURITY-186) jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206) jenkins: Stored XSS vulnerability in slave offline status message (SECURITY-214) jenkins: CSRF vulnerability in some administrative actions (SECURITY-225) jenkins: CSRF protection ineffective (SECURITY-233) jenkins: Jenkins plugin manager vulnerable to MITM attacks (SECURITY-234) jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218) server: patch operation should use patched object to check admission control server: build config to a strategy that isn't allowed by policy
GHSA-4gx2-r245-q6gm: Cross-Site Request Forgery (CSRF) vulnerability in Manoj Thulasidas Theme Tweaker plugin <= 5.20 versions.
CVSS v3.1: 4.3
GHSA-253p-9p9w-rg6r: ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a crafted file upload
CVSS v3.1: 9.8
CVE-2022-22780: Zoom Chat Susceptible to Zip Bombing
The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before version 5.6.3. This could lead to availability issues on the client host by exhausting system resources.
CVSS v3.1: 4.7
CVE-2026-3079: LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter
The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filters[orderby_order]' parameter in the 'learndash_propanel_template' AJAX action in all versions up to, and including, 5.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 6.5
CVE-2007-5437: The web console in CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 allows remote attackers to redirect users to arbitrary web sites via a crafted HTTP URL on port 6689.
CVSS v2.0: 5.8
CVE-2026-57296: Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.
CVE-2017-1356: IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 126683.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2017-6041: An Unrestricted Upload issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Cam v132, IPM3 Dual Cam v139, IPM3 Single Cam v132, P520, P574, SensorX13 QC flow line, SensorX23 QC Master, SensorX23 QC Slave, Speed Batcher, T374, T377, V36, V36B, and V36C; M3210 terminal associated with the same systems as the M3000 terminal identified above; M3000 desktop software associated with the same systems as the M3000 terminal identified above; MAC4 controller associated with the same systems as the M3000 terminal identified above; SensorX23 X-ray machine; SensorX25 X-ray machine; and MWS2 weighing system. This vulnerability allows an attacker to modify the operation and upload firmware changes without detection.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2019-4309: IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses hard coded credentials which could allow a local user to obtain highly sensitive information. IBM X-Force ID: 161035.
CVSS v3.0: 5.9
RHSA-2026:8167: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.0 release.
golang: net/url: Memory exhaustion in query parameter parsing in net/url crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509
CVSS v3.1: 7.5
CVE-2023-42040: PDF-XChange Editor mailForm Use-After-Free Code Execution Vulnerability
PDF-XChange Editor mailForm Use-After-Free Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the mailForm method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20663.
CVSS v3.0: 7.8
CVE-2024-25393: A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2.
CVSS v3.1: 9.8
CVE-2022-49815: erofs: fix missing xas_retry() in fscache mode
In the Linux kernel, the following vulnerability has been resolved:

erofs: fix missing xas_retry() in fscache mode

The xarray iteration only holds the RCU read lock and thus may encounter
XA_RETRY_ENTRY if there's process modifying the xarray concurrently.
This will cause oops when referring to the invalid entry.

Fix this by adding the missing xas_retry(), which will make the
iteration wind back to the root node if XA_RETRY_ENTRY is encountered.
CVSS v3.1: 5.5
GHSA-c73w-4rcj-2622: Typo3 API Install Tool vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
GHSA-53r4-pppm-xh7q: SQL injection vulnerability in the Educator extension 0.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
GHSA-557q-j5m4-32rv: Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect Access Control. On the Verifications page, after uploading an ID Card or Trade License and viewing it, ID Cards and Trade Licenses of other vendors/users can be viewed by changing the URL.
CVSS v3.1: 5.3
GHSA-5jjc-6f35-8hmp: Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large journal data field, which triggers a heap-based buffer overflow.
GHSA-g9w7-8hcr-36c9: A Win32k information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka "Win32k Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-0189.
CVSS v3.0: 3.3
GHSA-9p67-jm42-x3f6: Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1: 6.5
GHSA-f87g-8q5h-c2xf: An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code execution can occur via the bootloader. The LG ID is LVE-SMP-200006 (May 2020).
CVSS v3.1: 9.8
CVE-2013-6874: Stack-based buffer overflow in Vortex Light Alloy before 4.7.4 allows remote attackers to execute arbitrary code via a long URL in a .m3u file.
CVSS v2.0: 9.3
GHSA-w4qj-wrcj-6hfm: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
GHSA-v997-8gmf-mpww: Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
CVE-2002-0448: Xerver Free Web Server 2.10 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request that contains many "C:/" sequences.
CVSS v2.0: 5
GHSA-w932-f265-m42g: Macromedia JRun 3.0, 3.1, and 4.0 allow remote attackers to view the source code of .JSP files via Unicode encoded character values in a URL.