ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2026-49367: In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
CVSS v3.1: 8
CVE-2010-2271: Format string vulnerability in authcfg.cgi in Accoria Web Server (aka Rock Web Server) 1.4.7 allows remote attackers to have an unspecified impact via format string specifiers in the path (aka Password File) parameter.
CVSS v2.0: 7.5
CVE-2022-38310: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.
CVSS v3.1: 9.8
CVE-2017-6952: Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4 and earlier allows attackers to cause a denial of service (heap-based buffer overflow in a kernel driver) or possibly have unspecified other impact via a large value.
CVSS v3.0: 8.8
CVSS v2.0: 7.5
CVE-2025-31206: A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS v3.1: 4.3
GHSA-g98g-r7gf-2r25: Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
**Overview**
Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.**Am I Affected?**
You are affected by this vulnerability if you meet the following pre-conditions:Applications using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK:
 a. Auth0/symfony,
 b. Auth0/laravel-auth0,
 c. Auth0/wordpress,Session storage configured with CookieStore.**Fix**
Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.**Acknowledgement**
Okta would like to thank Félix Charette for discovering this vulnerability.
CVSS v3.1: 9.1
GHSA-pq6w-8h36-7f4v: Buffer-Overflow vulnerability at conv.c:68 of stsaz phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via the a crafted .wav file.
CVSS v3.1: 8.8
GHSA-7w87-cwwm-qff7: Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request.
CVSS v3.1: 9.8
CVE-2011-1193: Google V8, as used in Google Chrome before 10.0.648.127, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS v2.0: 7.5
GHSA-v33r-7jqx-q3xh: The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
CVSS v3.0: 5.5
GHSA-j4x3-m48p-j6xm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through <= 2.13.
CVSS v3.1: 7.1
GHSA-mxjg-fxmc-m49m: Missing Authorization vulnerability in socialmediafeather Social Media Feather allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Media Feather: from n/a through 2.1.3.
CVSS v3.1: 4.3
GHSA-ggwj-wrgj-7mh6: Heap-based buffer overflow in the QuickTime VR extension 7.2.0.240 in QuickTime.qts in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via a QTVR (QuickTime Virtual Reality) movie file containing a large size field in the atom header of a panorama sample atom.
GHSA-547m-r64p-j2m2: SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance.
GHSA-49mq-f6v3-c6q2: BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the index.php/admin/developer/upgrade/set-ftp-directory/ URI.
CVSS v3.0: 8.8
GHSA-4rch-2fh8-94vw: MySQL2 for Node Arbitrary Code Injection
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
CVSS v3.1: 9.8
CVE-2014-2444: Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to InnoDB.
CVSS v2.0: 6.5
cisco-sa-20190417-ise-ssl-dos: Cisco Identity Services Engine SSL Renegotiation Denial of Service Vulnerability
A vulnerability in the web interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service (DoS) condition.
The vulnerability is due to improper handling of Secure Sockets Layer (SSL) renegotiation requests. An attacker could exploit this vulnerability by sending renegotiation requests at a high rate. An successful exploit could increase the resource usage on the system, eventually leading to a DoS condition.


There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ise-ssl-dos ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ise-ssl-dos"]
CVSS v3.0: 5.3
CVE-2020-0150: In rw_t3t_message_set_block_list of rw_t3t.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-142280329
CVSS v3.1: 7.8
CVSS v2.0: 4.6
CVE-2022-32354: Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=user/manage_user&id=.
CVSS v3.1: 7.2
CVSS v2.0: 6.5
CVE-2025-60238: WordPress UNIVERSAM plugin <= 9.04.02 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <= 9.04.02.
CVSS v3.1: 9.8
CVE-2014-7616: The Physics Forums (aka com.tapatalk.physicsforumscom) application 3.9.22 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2017-7897: A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-vrqq-7396-7hq4: Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access.
CVSS v3.1: 6.1
GHSA-m33c-9wjp-qmwm: The Le Grand Bleu (aka com.appzone468) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-vwg3-8x87-rfjm: liveSite v2019.1 was discovered to contain a remote code execution (RCE) vulenrabiity via the component /livesite/edit_designer_region.php.
CVSS v3.1: 9.8
CVE-2024-21148: Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as  unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.1: 4.8
GHSA-2p8m-3vmg-8226: SQL injection vulnerability in main.php in Centreon 2.1.5 allows remote attackers to execute arbitrary SQL commands via the host_id parameter.
RHSA-2025:7458: Red Hat Security Advisory: xorg-x11-server-Xwayland security update
xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability X.Org: Xwayland: Use-after-free of the root cursor Xorg: xwayland: Buffer overflow in XkbVModMaskText() xorg: xwayland: Heap overflow in XkbWriteKeySyms() xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() xorg: xwayland: Use-after-free in PlayReleasedEvents() xorg: xwayland: Use-after-free in SyncInitTrigger()
CVSS v3.1: 7.8
GHSA-r4gq-hv2r-mrf5: Cross-site Scripting in librenms/librenms
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
CVSS v3.1: 6.1
CVE-2018-17688: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the setItems method of a ComboBox. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7069.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2019-15860: Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
GHSA-j3fw-52mj-hqjw: Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js. This vulnerability allows attackers to inject malicious code into a victim user's device via open redirection.
CVE-2010-0246: Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-3671, CVE-2009-3674, and CVE-2010-0245.
CVSS v2.0: 9.3
GHSA-vw4c-6hqg-68fm: EMC Isilon OneFS 7.1.x and 7.2.x before 7.2.1.3 and 8.0.x before 8.0.0.1, and IsilonSD Edge OneFS 8.0.x before 8.0.0.1, does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream, a similar issue to CVE-2016-2115.
CVSS v3.0: 5.9
CVE-2014-7717: The Mills-Hazel Property Mgmt (aka com.appexpress.millshazelpropertymanagement) application 3.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2023-5800: Insufficient input validation in VAPIX API create_overlay.cgi
Vintage,
member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi
did not have a sufficient input validation allowing for a possible remote code
execution. This flaw can only be exploited after authenticating with an
operator- or administrator-privileged service account. Axis has released patched AXIS OS
versions for the highlighted flaw. Please refer to the Axis security advisory
for more information and solution.
CVSS v3.1: 5.4
RHSA-2019:2060: Red Hat Security Advisory: dhcp security and bug fix update
dhcp: double-deletion of the released addresses in the dhcpv6 code leading to crash and possible DoS
CVSS v3.0: 5.9
CVE-2013-3650: Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resize_image.php, a different vulnerability than CVE-2013-3654.
CVSS v2.0: 5
GHSA-pv88-j6rg-r56p: Jenkins allows attackers to obtain sensitive information
The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.
GHSA-5x9h-55x2-p265: Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.
CVSS v3.1: 5.9
GHSA-fg69-qmx3-3vc8: Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address.
GHSA-q7c2-r69f-c8rv: A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-37160362.
CVSS v3.0: 9.8
GHSA-3429-h97r-hqqx: Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data.This impacts OmniStudio: before version 254.
CVSS v3.1: 7.5
GHSA-q5mp-p378-cg2q: Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.
CVSS v3.1: 7.5
CVE-2025-52913: A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
CVSS v3.1: 9.8
RHSA-2023:7506: Red Hat Security Advisory: thunderbird security update
Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer Mozilla: Use-after-free in MessagePort::Entangled Mozilla: Clickjacking permission prompts using the fullscreen transition Mozilla: Use-after-free in ReadableByteStreamQueueEntry::Buffer Mozilla: Using Selection API would copy contents into X11 primary selection. Mozilla: Incorrect parsing of relative URLs starting with "///" Mozilla: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5
CVSS v3.1: 8.8
CVE-2021-38014: Out of bounds write in Swiftshader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-c9m5-977f-rffv: Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.
CVSS v3.1: 8.8
CVE-1999-0856: login in Slackware 7.0 allows remote attackers to identify valid users on the system by reporting an encryption error when an account is locked or does not exist.
CVSS v2.0: 5
GHSA-2vhp-v3rh-j2qr: Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.
CVSS v3.0: 9.8
CVE-2018-0757: The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way objects are handled in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0810.
CVSS v3.0: 4.7
CVSS v2.0: 1.9
CVE-2024-12747: Rsync: race condition in rsync handling symbolic links
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.
CVSS v3.1: 5.6
CVE-2018-20477: An issue was discovered in S-CMS 3.0. It allows SQL Injection via the bank/callback1.php P_no field.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2022-0264: A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2019-11892: Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC)
A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in reading or modification of the SHC's configuration or triggering and restoring backups. In order to exploit the vulnerability, the adversary needs to have successfully paired an app or service, which requires user interaction.
CVSS v3.0: 7.5
GHSA-f4fm-h9m4-mq5g: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sergey Panasenko Sponsors Carousel plugin <= 4.02 versions.
CVSS v3.1: 5.9
CVE-2024-44133: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15. On MDM managed devices, an app may be able to bypass certain Privacy preferences.
CVSS v3.1: 5.5
CVE-2022-20781: Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface.
CVSS v3.1: 5.4
GHSA-f22p-xx2m-5g9m: A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.
GHSA-77vj-9qxr-p2qf: In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVSS v3.1: 5.5
GHSA-2252-jwp3-qxfh: A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.
CVSS v3.1: 10
CVE-2020-2144: Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS v3.1: 7.1
CVSS v2.0: 5.5
GHSA-wc9g-6j9w-hr95: YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
SummaryThe request to commence a site backup can be performed without authentication. Then these backups can also be downloaded without authentication.The archives are created with a predictable filename, so a malicious user could create an archive and then download the archive without being authenticated.DetailsCreate an installation using the instructions found in the docker folder of the repository, setup the site, and then send the request to create an archive, which you do not need to be authenticated for:Then to retrieve it, make a simple `GET` request like to the correct URL:A malicious attacker could simply fuzz this filename.PoCHere is a python script to fuzz this:ImpactDenial of Service - A malicious attacker could simply make numerous requests to create archives and fill up the file system with archives.Site Compromise - A malicious attacker can download the archive which will contain sensitive site information.
CVSS v3.1: 10
GHSA-wgp5-w6wq-7x25: The ReadOneDJVUImage function in coders/djvu.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed DJVU image.
CVSS v3.0: 6.5
CVE-2022-4366: Missing Authorization in lirantal/daloradius
Missing Authorization in GitHub repository lirantal/daloradius prior to master branch.
CVSS v3.0: 5.3
GHSA-2qx3-66fq-3wq2: Multiple SQL injection vulnerabilities in admin/aclass/admin_func.php in Arab Portal 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) X-Forwarded-For or (2) Client-IP HTTP header in a request to the default URI under admin/.
CVE-2007-0962: Cisco PIX 500 and ASA 5500 Series Security Appliances 7.0 before 7.0(4.14) and 7.1 before 7.1(2.1), and the FWSM 2.x before 2.3(4.12) and 3.x before 3.1(3.24), when "inspect http" is enabled, allows remote attackers to cause a denial of service (device reboot) via malformed HTTP traffic.
CVSS v2.0: 7.8
CVE-2004-1325: The getItemInfoByAtom function in the ActiveX control for Microsoft Windows Media Player 9.0 returns a 0 if the file does not exist and the size of the file if the file exists, which allows remote attackers to determine the existence of files on the local system.
CVSS v2.0: 5
GHSA-qppf-5wcp-vjwc: The shmctl function in Linux 2.6.9 and earlier allows local users to unlock the memory of other processes, which could cause sensitive memory to be swapped to disk, which could allow it to be read by other users once it has been released.
CVE-2019-25551: Sandboxie 5.30 Denial of Service via Program Alerts Buffer Overflow
Sandboxie 5.30 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Program Alerts configuration field. Attackers can paste a buffer of 5000 characters into the 'Select or enter a program' field during program alert configuration to trigger an application crash.
CVSS v4.0: 6.9
CVSS v3.1: 6.2
CVE-2019-9355: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-115903122
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2009-4720: SQL injection vulnerability in cgi-bin/gnudip.cgi in GnuDIP 2.1.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.5
GHSA-2c3g-5x92-qfrv: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
CVSS v3.1: 7.8