ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-86vm-vp8g-7929: In the Linux kernel, the following vulnerability has been resolved:net: ibm: emac: Fix use-after-free during device removalThe driver was using devm_register_netdev() which causes unregister_netdev()
to be deferred until the devres cleanup phase, which runs after emac_remove()
returns. This creates a use-after-free window where:emac_remove() is called, which tears down hardware (cancels work, detaches
modules, unregisters from MAL)emac_remove() returnsdevres cleanup runs and finally calls unregister_netdev()During step 3, the network stack might still process packets, triggering
emac_irq(), emac_poll(), or other handlers that access now-freed hardware
resources (dev->emacp, dev->mal, etc.).Fix this by replacing devm_register_netdev() with manual register_netdev()
and calling unregister_netdev() at the beginning of emac_remove(), before
any hardware teardown. This ensures the network device is fully stopped and
unregistered before hardware resources are released.The change is safe because:dev->ndev is assigned very early in probe (before any error paths that
could bypass emac_remove)platform_set_drvdata() is only called after successful registration, so
emac_remove() only runs for fully registered devicesunregister_netdev() is idempotent and safe to call on any registered device
GHSA-2j53-64jx-6w47: Heap-based buffer overflow in the ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel 2.6.37.2 and earlier might allow local users to gain privileges or obtain sensitive information via a crafted LDM partition table.
CVE-2024-7540: oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability
oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.

The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23307.
CVSS v3.0: 3.3
CVE-2026-28466: OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass
OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run commands. Attackers with valid gateway credentials can inject approval control fields to execute arbitrary commands on connected node hosts, potentially compromising developer workstations and CI runners.
CVSS v4.0: 9.4
CVSS v3.1: 9.9
GHSA-9w5v-rmgq-p82g: This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format using a hard-coded key. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-10185.
CVSS v3.1: 5.9
CVE-2020-0213: In hevcd_fmt_conv_420sp_to_420sp_av8 of ihevcd_fmt_conv_420sp_to_420sp.s, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10 Android-11 Android ID: A-143464314
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2019-19168: Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
CVSS v3.1: 7.8
GHSA-684j-qvrf-6fvq: Multiple SQL injection vulnerabilities in aWebBB 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter to (a) accounts.php, (b) changep.php, (c) editac.php, (d) feedback.php, (e) fpass.php, (f) login.php, (g) post.php, (h) reply.php, or (i) reply_log.php; (2) p parameter to (j) dpost.php; (3) c parameter to (k) list.php or (l) ndis.php; or (12) q parameter to (m) search.php.
CVE-2025-11385: Tenda AC20 fast_setting_wifi_set sscanf buffer overflow
A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The affected element is the function sscanf of the file /goform/fast_setting_wifi_set. The manipulation of the argument timeZone leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2024-5958: SQLi in Eliz Software's Panel
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection.

This issue affects Panel: before v2.3.24.
CVSS v4.0: 9.4
CVE-2015-8519: Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8520, CVE-2015-8521, and CVE-2015-8522.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2021-45764: GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function shift_chunk_offsets.isra().
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2025-23522: WordPress HM Portfolio plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew Haines-Young HM Portfolio hm-portfolio allows Reflected XSS.This issue affects HM Portfolio: from n/a through <= 1.1.1.
CVSS v3.1: 7.1
GHSA-x3w8-63xm-cwmm: The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the generator output.
CVSS v3.1: 5.5
CVE-2026-21004: Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.
CVSS v4.0: 6.9
GHSA-w244-c4f9-vj58: SQL injection vulnerability in kategori.asp in Furkan Tastan Blog allows remote attackers to execute arbitrary SQL commands via the id parameter in a goster kat action.
GHSA-pwf3-h35x-h5rg: Turning all screens off in Plasma-workspace and kscreenlocker while the lock screen is shown can result in the screen being unlocked when turning a screen on again.
CVSS v3.0: 6.8
GHSA-cxmv-j56r-fqw2: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12708.
CVSS v3.1: 7.8
GHSA-3q82-rr95-h5gf: The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
CVSS v3.1: 8.8
GHSA-r9m4-pj3v-82vg: Cross-site scripting (XSS) vulnerability in modules/headlines/magpierss/scripts/magpie_debug.php in RunCms 2.1, when the Headlines module is enabled, allows remote attackers to inject arbitrary web script or HTML via the url parameter.
GHSA-86xr-hhp2-92cj: Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.2.
CVSS v3.1: 5.3
CVE-2008-6358: SQL injection vulnerability in group_index.php in Social Groupie allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0: 7.5
RHSA-2024:4107: Red Hat Security Advisory: kernel security and bug fix update
kernel: race condition in snd_pcm_hw_free leading to use-after-free kernel: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls kernel: netfilter: nf_tables: disallow anonymous set with timeout flag kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection()
CVSS v3.1: 5.5
CVE-2024-24980: Protection mechanism failure in some 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v4.0: 6.9
CVSS v3.1: 6.1
CVE-2016-7934: The RTCP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtcp_print().
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-5m5v-pwj7-rj26: Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.
CVSS v3.1: 2.7
CVE-2022-47636: A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.
CVSS v3.1: 7.8
CVE-2004-2262: ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to execute arbitrary code by uploading a PHP file via the upload parameter to images.php.
CVSS v2.0: 7.5
CVE-2001-0755: Buffer overflow in ftp daemon (ftpd) 6.2 in Debian GNU/Linux allows attackers to cause a denial of service and possibly execute arbitrary code via a long SITE command.
CVSS v2.0: 7.5
CVE-2017-15722: In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string.
CVSS v3.0: 5.9
CVSS v2.0: 4.3
CVE-2021-39994: There is an arbitrary address access vulnerability with the product line test code.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2005-3548: Directory traversal vulnerability in Task Manager in Invision Power Board (IP.Board) 2.0.1 allows limited remote attackers to include files via a ..  (dot dot) in the "Task PHP File To Run" field.
CVSS v2.0: 4
GHSA-36vh-hj6f-jcqm: EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses world-writable permissions for cache directories, which allows local users to gain privileges via an unspecified symlink attack.
GHSA-398m-55cm-6j6x: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS v3.1: 7.6
CVE-2025-49256: WordPress Sapa theme <= 1.1.14 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Sapa sapa allows PHP Local File Inclusion.This issue affects Sapa: from n/a through <= 1.1.14.
CVSS v3.1: 8.1
CVE-2018-8595: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8596.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
CVE-2023-40180: Denial of service vulnerability in silverstripe-graphql via recursive queries
 silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. This issue has been addressed in versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1: 7.5
GHSA-5cg6-6f7f-388q: Cross-Site Request Forgery (CSRF) vulnerability in dactum Clickbank WordPress Plugin (Niche Storefront) allows Stored XSS. This issue affects Clickbank WordPress Plugin (Niche Storefront): from n/a through 1.3.5.
CVSS v3.1: 7.1
GHSA-fp2q-62rv-wjc8: FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code.
CVE-2010-2772: Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain privileges, as demonstrated in the wild in July 2010 by the Stuxnet worm, a different vulnerability than CVE-2010-2568.
CVSS v3.1: 7.8
CVSS v2.0: 6.9
CVE-2020-1950: A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
RHSA-2022:6856: Red Hat Security Advisory: rh-ruby27-ruby security, bug fix, and enhancement update
ruby: buffer overflow in CGI.escape_html ruby: Regular expression denial of service vulnerability of Date parsing methods ruby: Cookie prefix spoofing in CGI::Cookie.parse ruby: Buffer overrun in String-to-Float conversion
CVSS v3.1: 6.2
CVE-2024-1027: SourceCodester Facebook News Feed Like Post unrestricted upload
A vulnerability, which was classified as critical, was found in SourceCodester Facebook News Feed Like 1.0. Affected is an unknown function of the component Post Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-252300.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2008-0078: Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via a crafted image, aka "Argument Handling Memory Corruption Vulnerability."
CVSS v2.0: 9.3
CVE-2012-2405: Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attack vectors, a different vulnerability than CVE-2012-1113.
CVSS v2.0: 10
CVE-2017-9197: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init()
In the Linux kernel, the following vulnerability has been resolved:

amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init()

On failure to set the epp, the function amd_pstate_epp_cpu_init()
returns with an error code without freeing the cpudata object that was
allocated at the beginning of the function.

Ensure that the cpudata object is freed before returning from the
function.

This memory leak was discovered by Claude Opus 4.6 with the aid of
Chris Mason's AI review-prompts
(https://github.com/masoncl/review-prompts/tree/main/kernel).
CVE-2015-4352: Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors.
CVSS v2.0: 5.8
CVE-2022-1508: An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() function with some special parameters. This flaw allows a local user to read some memory out of bounds.
CVSS v3.1: 6.1
CVE-2005-1455: Buffer overflow in the sql_escape_func function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote attackers to cause a denial of service (crash).
CVSS v2.0: 7.5
CVE-2022-42241: Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_message.
CVSS v3.1: 7.2
GHSA-qwrm-7225-vjff: A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of the file /index.php of the component Student Self-Registration Endpoint. The manipulation leads to improper access controls. Remote exploitation of the attack is possible.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVE-2017-17587: FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c parameter.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2020-2546: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Application Container - JavaEE). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0: 9.8
GHSA-rp34-85x3-3764: Cross-site Scripting in librenms
Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
CVSS v3.1: 6.1
RHSA-2026:27862: Red Hat Security Advisory: memcached security update
memcached: memcached: Username enumeration via timing side channel
CVSS v3.1: 8.1
GHSA-c4qm-58hj-j6pj: OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation
SummaryBrowser snapshot and screenshot routes could expose internal page content after navigation.Affected Packages / VersionsPackage: `openclaw`Ecosystem: npmAffected versions: `< 2026.4.14`Patched versions: `>= 2026.4.14`ImpactAuthenticated browser tool callers could use snapshot, screenshot, or tab routes that did not consistently validate the final browser target after route-driven navigation. In restrictive browser SSRF configurations this could expose content from internal or otherwise disallowed pages.Technical DetailsThe fix re-checks browser snapshot, screenshot, and tab route results against the configured browser SSRF policy before returning page content. Regression coverage was added around snapshot/screenshot and tab-route flows.FixThe issue was fixed in #66040. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.Fix Commit(s)`b75ad800a59009fc47eaa3471410f69046150e59`PR: #66040Release Process NoteUsers should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.CreditsThanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
CVSS v4.0: 6
CVSS v3.1: 7.7
CVE-2024-35515: Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.
CVSS v3.1: 9.8
GHSA-pp3f-xrw5-q5j4: Lancet vulnerable to path traversal when unzipping files
Impact_What kind of vulnerability is it? Who is impacted?_ZipSlip issue when use fileutil package to unzip files.Patches_Has the problem been patched? What versions should users upgrade to?_It will fixed in v2.1.10, Please upgrade version to v2.1.10 or above.
Users who use v1.x.x should upgrade v1.3.4 or above.Workarounds_Is there a way for users to fix or remediate the vulnerability without upgrading?_No, users have to upgrade version.
CVSS v3.1: 8.8
CVE-2008-0159: SQL injection vulnerability in index.php in eggBlog 3.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the eggblogpassword parameter in a cookie.
CVSS v2.0: 6.8
CVE-2020-4678: IBM Security Guardium 11.2 could allow an attacker with admin access to obtain and read files that they normally would not have access to. IBM X-Force ID: 186423.
CVSS v3.0: 4.9
CVE-2006-7058: Multiple cross-site scripting (XSS) vulnerabilities in Sphider before 1.3.1c allow remote attackers to inject arbitrary web script or HTML via the catid parameter to (1) templates/standard/search_form.html and (2) templates/dark/search_form.html.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 4.3
CVE-2025-68476: KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3.
CVSS v4.0: 8.2
CVE-2010-5028: SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php.
CVSS v2.0: 7.5
GHSA-gffm-74c3-652g: Denial of Service was found in Horde_Image 2.x before 2.5.0 via a crafted URL to the "Null" image driver.
CVSS v3.0: 5.7
GHSA-658j-rfvq-5wqq: A vulnerability was determined in code-projects Simple ChatBox up to 1.0. This affects an unknown part of the file /chatbox/insert.php of the component Endpoint. Executing a manipulation of the argument msg can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-7ghr-75pj-w6vc: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes.
CVSS v3.1: 8.7
GHSA-8746-f7wh-cvv9: Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served.
CVE-2018-1673: IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145108.
CVSS v3.0: 6.1
GHSA-mvwx-xmwm-v4x2: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2024-30625: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the entrys parameter from fromAddressNat function.
CVSS v3.1: 8