ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-jm4q-f3h3-j5cf: An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023.
CVSS v3.1: 9.8
GHSA-m5mh-rmcg-x9pm: Missing Authorization vulnerability in Prasad Kirpekar WP Meta and Date Remover allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meta and Date Remover: from n/a through 2.3.0.
CVSS v3.1: 5.4
CVE-2026-0562: Insecure Direct Object Reference (IDOR) in parisneo/lollms
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not implement proper authorization checks, enabling Insecure Direct Object Reference (IDOR) attacks. Specifically, the `/api/friends/requests/{friendship_id}` endpoint fails to verify whether the authenticated user is part of the friendship or the intended recipient of the request. This vulnerability can lead to unauthorized access, privacy violations, and potential social engineering attacks. The issue has been addressed in version 2.2.0.
CVSS v3.0: 8.3
CVE-2006-6760: Multiple PHP remote file inclusion vulnerabilities in template.php in Phpmymanga 0.8.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) actionsPage or (2) formPage parameter.
CVSS v2.0: 7.5
CVE-2010-0916: Unspecified vulnerability in Oracle OpenSolaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to rdist.
CVSS v2.0: 6.2
GHSA-96pc-32h7-wj35: The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.0. This is due to the plugin not properly validating a user's identity prior to (1) performing a post-booking auto-login or (2) updating their profile details (e.g. password). This makes it possible for unauthenticated attackers to (1) login as an arbitrary user if their email address is known or (2) change an arbitrary user's password, including administrators, and leverage that to gain access to their account.
CVSS v3.1: 9.8
GHSA-2cr5-m73q-5h4g: Cross-site scripting (XSS) vulnerability in DataparkSearch before 4.37 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-1755: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0235 and CVE-2014-1751.
CVSS v2.0: 9.3
GHSA-9hmr-72rx-4c35: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjema WP-NOTCAPTCHA allows Reflected XSS. This issue affects WP-NOTCAPTCHA: from n/a through 1.3.1.
CVSS v3.1: 7.1
GHSA-v522-54cm-3jxm: There is an insufficient authentication vulnerability in some Huawei band products. Successful exploit could allow the attacker to spoof then connect to the band.
CVSS v3.1: 6.5
CVE-2007-3292: Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrary PHP code by specifying a PHP file type in a parameter intended for "a small image" associated with an article.
CVSS v2.0: 7.5
RHSA-2024:6153: Red Hat Security Advisory: 389-ds-base security update
389-ds-base: Malformed userPassword hash may cause Denial of Service
CVSS v3.1: 5.7
GHSA-cf9j-q6m7-7h5j: Unspecified vulnerability in Adobe ColdFusion 8 and 8.0.1 and ColdFusion MX 7.0.2 allows local users to bypass sandbox restrictions, and obtain sensitive information or possibly gain privileges, via unknown vectors.
CVE-2016-10029: The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2021-40822: GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-r6f4-5657-3fp7: An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability.
CVSS v3.1: 7.4
RHSA-2026:0491: Red Hat Security Advisory: postgresql security update
postgresql: CREATE STATISTICS does not check for schema CREATE privilege postgresql: libpq: libpq undersizes allocations, via integer wraparound
CVSS v3.1: 7.5
RHSA-2025:15338: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.8 Images Security Update
org.keycloak/keycloak-services: Keycloak SMTP Inject Vulnerability org.keycloak/keycloak-model-storage-service: Variable injection into environment variables
CVSS v3.1: 4.9
GHSA-cvx4-vgw7-p9gv: platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.
CVE-2026-2784: Mitigation bypass in the DOM: Security component
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVSS v3.1: 9.8
CVE-2012-1761: Unspecified vulnerability in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to UI Framework.
CVSS v2.0: 4.3
GHSA-rpq2-3p69-p45w: Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests over the network. On successful exploitation, an attacker can break the whole application making it inaccessible.
CVSS v3.1: 7.5
CVE-2012-4383: contao prior to 2.11.4 has a sql injection vulnerability
CVSS v3.1: 8.8
CVSS v2.0: 6.5
GHSA-v6vc-vm6m-wvhp: The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
CVSS v3.0: 7.3
CVE-2026-27079: WordPress Amfissa theme <= 1.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Amfissa amfissa allows PHP Local File Inclusion.This issue affects Amfissa: from n/a through <= 1.1.
CVSS v3.1: 8.1
CVE-2015-4654: SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
CVSS v2.0: 7.5
CVE-2024-11196: Multi-column Tag Map <= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcode
The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mctagmap shortcode in all versions up to, and including, 17.0.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2024-10480: 3DPrint Lite < 2.1 - Settings Update via CSRF
The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVSS v3.1: 4.3
CVE-2021-31794: Settings.aspx?view=About in Directum 5.8.2 allows XSS via the HTTP User-Agent header.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2023-54167: m68k: mm: Move initrd phys_to_virt handling after paging_init()
In the Linux kernel, the following vulnerability has been resolved:

m68k: mm: Move initrd phys_to_virt handling after paging_init()

When booting with an initial ramdisk on platforms where physical memory
does not start at address zero (e.g. on Amiga):

    initrd: 0ef0602c - 0f800000
    Zone ranges:
      DMA      [mem 0x0000000008000000-0x000000f7ffffffff]
      Normal   empty
    Movable zone start for each node
    Early memory node ranges
      node   0: [mem 0x0000000008000000-0x000000000f7fffff]
    Initmem setup node 0 [mem 0x0000000008000000-0x000000000f7fffff]
    Unable to handle kernel access at virtual address (ptrval)
    Oops: 00000000
    Modules linked in:
    PC: [<00201d3c>] memcmp+0x28/0x56

As phys_to_virt() relies on m68k_memoffset and module_fixup(), it must
not be called before paging_init().  Hence postpone the phys_to_virt
handling for the initial ramdisk until after calling paging_init().

While at it, reduce #ifdef clutter by using IS_ENABLED() instead.
GHSA-2456-4748-m2m2: Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through 2.29.
CVSS v3.1: 4.3
GHSA-85cm-vx4m-p4x4: A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded with content type text/html.
CVSS v3.0: 6.1
GHSA-8hc5-v62f-53vj: WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplete. An attacker could add/delete any vhosts without the consent of the owner.
CVSS v3.0: 6.5
GHSA-rpc7-gf58-v3x2: Magento Open Source allows Incorrect Authorization
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.
CVSS v4.0: 6.3
CVSS v3.1: 8.8
CVE-2025-10900: MODEL File Parsing Out-of-Bounds Write Vulnerability
AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS v3.1: 7.8
GHSA-24jr-8pxp-69pm: klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.
CVSS v3.1: 9.8
CVE-2025-4370: Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload
The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_urls function as well as missing path validation in store_file function in all versions up to, and including, 2.6.20. This makes it possible for unauthenticated attackers to upload .TXT files on the affected site's server.
CVSS v3.1: 5.3
CVE-2023-29306: Adobe Connect Reflected Cross-Site Scripting (XSS) Arbitrary code execution
Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1: 6.1
CVE-2020-25604: An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests between its vCPUs, the locking model used allows for a second vCPU of the same guest (also operating on the timers) to release a lock that it didn't acquire. The most likely effect of the issue is a hang or crash of the hypervisor, i.e., a Denial of Service (DoS). All versions of Xen are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only x86 HVM guests can leverage the vulnerability. x86 PV and PVH cannot leverage the vulnerability. Only guests with more than one vCPU can exploit the vulnerability.
CVSS v3.1: 4.7
CVSS v2.0: 1.9
GHSA-w8wr-v3q8-68hg: Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query.
CVSS v3.1: 9.8
GHSA-m3jw-62m7-jjcm: typed-ast Out-of-bounds Read
typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
CVSS v3.1: 7.5
RHSA-2008:0175: Red Hat Security Advisory: openoffice.org security update
openoffice.org: Quattro Pro files handling heap overflows in Attribute and Font records openoffice.org: EMF files parsing EMR_BITBLT record heap overflows openoffice.org: Quattro Pro files parsing integer underflow openoffice.org: OLE files parsing heap overflows
GHSA-69f9-h8f9-7vjf: OS Command Injection in Snyk php plugin
The Snyk php plugin is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.
CVSS v4.0: 7.5
CVSS v3.1: 7.5
CVE-2008-3282: Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1, on 64-bit platforms, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document, related to a "numeric truncation error," a different vulnerability than CVE-2008-2152.
CVSS v3.1: 7.8
CVSS v2.0: 9.3
CVE-2025-3692: SourceCodester Online Eyewear Shop Master.php cross site scripting
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
GHSA-q6p3-235q-rj6w: Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Core-My Services.
CVE-2015-4162: XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data.
CVSS v2.0: 4
CVE-2009-1069: Multiple cross-site scripting (XSS) vulnerabilities in the node edit form feature in Drupal Content Construction Kit (CCK) 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the (1) titles of candidate referenced nodes in the Node reference sub-module and the (2) names of candidate referenced users in the User reference sub-module.
CVSS v2.0: 4.3
GHSA-rfm6-5393-x9wf: An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow.
CVSS v3.1: 7.5
GHSA-cw57-3gg4-75xr: A vulnerability was found in Tenda W15E 15.11.0.14. It has been classified as critical. Affected is the function guestWifiRuleRefresh. The manipulation of the argument qosGuestDownstream leads to stack-based buffer overflow. It is possible to launch the attack remotely. VDB-261870 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 8.8
GHSA-2q78-jf36-cvpg: libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file, related to the tiff_decode_tag and decode_frame functions.
CVSS v3.0: 8.8
CVE-2023-6181: An oversight in BCB handling of reboot reason that allows for persistent code execution
CVSS v3.1: 9.8
GHSA-9xm7-qxg2-g5p4: The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
CVSS v3.1: 4.8
CVE-2008-5900: CodeAvalanche Articles stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the administrator password via a direct request for _private/CAArticles.mdb.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.5
CVE-2001-1282: Ipswitch IMail 7.04 and earlier records the physical path of attachments in an e-mail message header, which could allow remote attackers to obtain potentially sensitive configuration information.
CVSS v2.0: 5
CVE-2025-6918: SQLi in Ncvav's Virtual PBX Software
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection.

This issue affects Virtual PBX Software: before 09.07.2025.
CVSS v3.1: 9.8
GHSA-xvxm-rm97-hmmp: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-30141, CVE-2022-30143, CVE-2022-30146, CVE-2022-30149, CVE-2022-30153, CVE-2022-30161.
CVSS v3.1: 7.5
GHSA-46cj-j92w-jf4m: PHP remote file inclusion vulnerability in include/wysiwyg/spaw_control.class.php in the icontent 4.5 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter.  NOTE: this issue is probably a duplicate of CVE-2006-4656.
GHSA-g57r-4mv6-3958: Windows Remote Access Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-xww8-g9jm-p823: Stack-based buffer overflow in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode, allows remote attackers to execute arbitrary code via a long filename in a GET request with an "Accept-Encoding: gzip" header.
GHSA-8664-5q35-2x9f: Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability."
RHSA-2025:4451: Red Hat Security Advisory: yelp security update
yelp: Arbitrary file read
CVSS v3.1: 7.4
GHSA-gv6f-6f67-8vrw: Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments.
CVSS v3.0: 5.4
GHSA-8wxp-wp4j-j684: Persistent Cross-Site scripting vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51. The vulnerability could allow persistent XSS attack.
CVE-2024-38631: iio: adc: PAC1934: fix accessing out of bounds array index
In the Linux kernel, the following vulnerability has been resolved:

iio: adc: PAC1934: fix accessing out of bounds array index

Fix accessing out of bounds array index for average
current and voltage measurements. The device itself has
only 4 channels, but in sysfs there are "fake"
channels for the average voltages and currents too.
CVSS v3.1: 7.8
RHSA-2025:17123: Red Hat Security Advisory: kernel-rt security update
kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw kernel: drm/gem: Acquire references on GEM handles for framebuffers kernel: vsock: Fix transport_* TOCTOU kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry kernel: smb: client: fix use-after-free in cifs_oplock_break
CVSS v3.1: 7
CVE-2023-33903: In FM service, there is a possible missing params check.  This could lead to local denial of service with System execution privileges needed.
CVSS v3.1: 4.4
CVE-2023-34394: Keysight N6845A Relative Path Traversal







In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to an improper path validation, which could result in local privilege escalation or a denial-of-service condition.














CVSS v3.1: 7.8
CVE-2024-20696: Windows libarchive Remote Code Execution Vulnerability
Windows libarchive Remote Code Execution Vulnerability
CVSS v3.1: 7.3
CVE-2015-2609: Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to CPU performance counters drivers.
CVSS v2.0: 4.9
GHSA-vq39-x4rp-9f46: Cross-site scripting (XSS) vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Quality Manager (RQM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Team Concert (RTC) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Requirements Composer (RRC) 4.x through 4.0.7; and Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
RHSA-2026:3489: Red Hat Security Advisory: go-toolset:rhel8 security update
golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy
CVSS v3.1: 7.4
GHSA-w6m8-jhpf-wj94: Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7
GHSA-vpc7-8x7g-73gx: The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS v3.1: 5.4
CVE-2025-52734: WordPress CropRefine Plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 CropRefine croprefine allows Reflected XSS.This issue affects CropRefine: from n/a through <= 1.2.1.
CVSS v3.1: 7.1
CVE-2021-26786: An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbitrary code via the purchace code to the config.php.
CVSS v3.1: 8.8
CVSS v2.0: 6.5