ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-x3wm-hffr-chwm: Amazon JDBC Driver for Redshift SQL Injection via line comment generation
ImpactSQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value.There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected.PatchThis issue is patched in driver version 2.1.0.28.WorkaroundsDo not use the connection property `preferQueryMode=simple`. (NOTE: If you do not explicitly specify a query mode, then you are using the default of extended query mode and are not affected by this issue.)ReferencesSimilar to finding in Postgres JDBC: https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56If you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
CVSS v3.1: 10
GHSA-pxrr-hq57-q35p: dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
SummaryDynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @jinja resolver.
When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment.If an attacker can influence configuration sources such as:
environment variables
.env files
container environment configuration
CI/CD secrets
they can execute arbitrary OS commands on the host system.
In addition, the @format resolver allows object graph traversal, which may expose sensitive runtime objects and environment variables.DetailsThe vulnerability arises because Dynaconf's string resolvers lack proper security boundaries.@jinja Resolver
The @jinja resolver renders templates using full Jinja2 evaluation.
However, the rendering context is not sandboxed, which allows attackers to access Python's internal attributes.
Using objects such as cycler, attackers can reach Python's __globals__ and import the os module.Example attack path
cycler
 → __init__
 → __globals__
 → os
 → popen()
This leads to arbitrary command execution.@format Resolver
The @format resolver performs Python string formatting using internal objects.
This allows attackers to traverse Python's object graph and access sensitive runtime objects.
Example traversal:
{this.__class__.__init__.__globals__[os].environ}
This can exposeAPI keysdatabase credentialsinternal service tokensenvironment secretsPoCImpactSuccessful exploitation allows attackers to:Execute arbitrary OS commands on the host systemAccess sensitive environment variablesCompromise application secretsFully compromise the running application process
Because configuration values may originate from CI/CD pipelines, container orchestration systems, or environment injection, this vulnerability can become remotely exploitable in real-world deployments.Remediation / Mitigation (Examples)Use Jinja2 sandbox for template renderingRestrict @format usage to trusted values
CVSS v3.1: 7.5
CVE-2001-1567: Lotus Domino server 5.0.9a and earlier allows remote attackers to bypass security restrictions and view Notes database files and possibly sensitive Notes template files (.ntf) via an HTTP request with a large number of "+" characters before the .nsf file extension, which are converted to spaces by Domino.
CVSS v2.0: 5
CVE-2024-56708: EDAC/igen6: Avoid segmentation fault on module unload
In the Linux kernel, the following vulnerability has been resolved:

EDAC/igen6: Avoid segmentation fault on module unload

The segmentation fault happens because:

During modprobe:
1. In igen6_probe(), igen6_pvt will be allocated with kzalloc()
2. In igen6_register_mci(), mci->pvt_info will point to
   &igen6_pvt->imc[mc]

During rmmod:
1. In mci_release() in edac_mc.c, it will kfree(mci->pvt_info)
2. In igen6_remove(), it will kfree(igen6_pvt);

Fix this issue by setting mci->pvt_info to NULL to avoid the double
kfree.
CVSS v3.1: 7.8
GHSA-g524-49q8-vhcm: A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIP leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256895. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 8.8
CVE-2019-16969: In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2023-6355: 

Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. 

This issue affects: Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)).


CVSS v3.1: 6.8
CVE-2014-5391: Cross-site scripting (XSS) vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote attackers to inject arbitrary web script or HTML via the hash property (location.hash).
CVSS v2.0: 4.3
RHSA-2017:0253: Red Hat Security Advisory: spice-server security update
spice: Buffer overflow in main_channel_alloc_msg_rcv_buf when reading large messages spice: Remote DoS via crafted message
CVSS v3.0: 7.5
CVE-2012-5254: Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than other Flash Player buffer overflow CVEs listed in APSB12-22.
CVSS v2.0: 10
GHSA-6w6g-q7qh-cv9h: Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 6.3
GHSA-xg24-qhg2-gj63: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system.
CVSS v3.1: 4.9
CVE-2019-19413: There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation, a remote attacker could exploit this vulnerability by sending malformed packets to the target devices. Successful exploit could cause the affected system crash.
CVSS v3.1: 7.5
CVSS v2.0: 7.8
CVE-2025-8416: Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection
The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 7.5
GHSA-wf94-c37g-7c29: Unspecified vulnerability in Workflow Cartridge, as used in Oracle Database Server 9.2.0.1, 10.1.0.2, and 10.2.0.1; Application Server 9.0.4.3 and 10.1.2.0.2; Collaboration Suite 10.1.2; and E-Business Suite; has unknown impact and remote authenticated attack vectors, aka OWF01.
CVE-2024-6760: ktrace(2) fails to detach when executing a setuid binary
A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users to trace and inspect the behavior of setuid programs.

The bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database.
CVSS v3.1: 7.5
GHSA-7xxg-7678-587v: The JPXStream::readTilePartData function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf file, as demonstrated by pdftohtml.
CVSS v3.0: 5.5
GHSA-qqc4-wwg4-7292: An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors.
CVSS v3.1: 4.1
GHSA-8486-h39x-cx2f: Jenkins Configuration as Code Plugin has Insufficiently Protected Credentials
A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin.
CVSS v3.0: 8.8
GHSA-mrwq-x4v8-fh7p: Pygments vulnerable to ReDoS
A ReDoS issue was discovered in `pygments/lexers/smithy.py` in Pygments until 2.15.0 via SmithyLexer.
CVSS v4.0: 6.8
CVSS v3.1: 5.5
CVE-2024-47392: WordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through <= 5.7.5.
CVSS v3.1: 6.5
CVE-2023-21639: Buffer Copy Without Checking the Size of Input in Audio
Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.
CVSS v3.1: 6.7
GHSA-4mx9-6v75-wm47: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are Prior to 6.1.42 and  prior to 7.0.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.4
CVE-2002-2106: PHP remote file inclusion vulnerability in WikkiTikkiTavi before 0.21 allows remote attackers to execute arbitrary PHP code via the TemplateDir variable, as demonstrated using conflict.php.
CVSS v2.0: 7.5
CVE-2006-0926: Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.
CVSS v2.0: 2.6
GHSA-2rh4-xgmq-63jp: XXE vulnerability in Jenkins Parasoft Findings Plugin
Parasoft Findings Plugin implements a static analysis parser for various Parasoft products and integrates with [Warnings Plugin](https://plugins.jenkins.io/warnings) (10.4.1 and earlier) and [Warnings NG Plugin](https://plugins.jenkins.io/warnings-ng) (10.4.2 and newer).Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the Parasoft Findings parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.Parasoft Findings Plugin 10.4.4 disables external entity resolution for its XML parser.
CVSS v3.0: 7.1
ICSA-21-266-01: Trane Symbio (Update B)
The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.CVE-2021-38448 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H).
CVSS v3.0: 7.5
GHSA-qghc-w7jx-4fqg: Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)SU1, 7.x before 7.1(5), and 8.0 before 8.0(2) allow remote attackers to cause a denial of service (device reload or voice-services outage) via crafted SIP registration traffic over UDP, aka Bug IDs CSCtf72678 and CSCtf14987.
GHSA-phwc-6r39-22r4: Opera before 11.50 allows remote attackers to cause a denial of service (disk consumption) via invalid URLs that trigger creation of error pages.
CVE-2024-43112: Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129.
CVSS v3.1: 6.1
GHSA-vhmx-6whg-m8hv: Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.
GHSA-jjgq-jq8g-24w4: Dolibarr SQL injection vulnerability in don/list.php
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
CVSS v3.0: 9.8
GHSA-7jv7-hr35-fwjr: An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).
CVSS v3.1: 6.5
CVE-2022-43664: A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected documents. A specially crafted document can trigger reuse of freed memory, which can lead to further memory corruption and potentially result in arbitrary code execution. An attacker can provide a malicious document to trigger this vulnerability.
CVSS v3.1: 7.8
GHSA-9qfx-2rgm-h5rf: Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server to return request payloads from other clients. This happens when the TCP length prefix is malformed (len differs from actual packet len), and due to a concurrency/buffering issue, even when the lengths match. A length prefix that is smaller than the actual packet size increases information leakage. In summary, this vulnerability allows an attacker to see DNS queries of other clients.
CVSS v3.1: 6.5
GHSA-pgf8-34vf-j4g8: Multiple eval injection vulnerabilities in Vote! Pro 4.0, and possibly earlier, allow remote attackers to execute arbitrary code via requests to unspecified PHP scripts with the poll_id parameter, which is supplied to eval function calls, a different set of vectors than CVE-2007-0504.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-crmg-49rh-p3hp: A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1.
CVSS v3.0: 2.4
GHSA-8q44-9g8q-jmqv: Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges.
CVSS v3.1: 8.2
CVE-2013-0138: BitZipper 2013 before Update 1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ZIP archive.
CVSS v2.0: 9.3
GHSA-239f-m535-8fmf: Buffer overflow in RDISERVER in Honeywell Uniformance Process History Database (PHD) R310, R320, and R321 allows remote attackers to cause a denial of service (service outage) via unspecified vectors.
CVSS v3.0: 7.5
GHSA-69p6-gp5x-j269: snapd failed to properly check the destination of symbolic links when extracting a snap
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
CVSS v4.0: 2.4
CVSS v3.1: 4.8
GHSA-8rmc-4498-fj7g: Multiple directory traversal vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to (1) index.php, (2) register.php, (3) login.php, or (4) statistics.php.
GHSA-gx8m-f3mp-fg99: formwork Cross-site scripting vulnerability in Markdown fields
ImpactUsers with access to the administration panel with page editing permissions could insert `<script>` tags in markdown fields, which are exposed on the publicly accessible site pages, leading to potential XSS injections.Patches[**Formwork 1.13.0**](https://github.com/getformwork/formwork/releases/tag/1.13.0) has been released with a patch that solves this vulnerability. Now the system config option `content.safe_mode` (enabled by default) controls whether HTML tags and potentially dangerous links are escaped. This is configurable as in some cases more flexibility should be given. Panel users should be only a controlled group of editors, which cannot enable the option by themselves, and not a generic group. This mitigates the chance of introducing vulnerabilities.[**Formwork 2.x** (6adc302)](https://github.com/getformwork/formwork/commit/6adc302f5a294f2ffbbf1571dd4ffea6b7876723) adds a similar `content.safeMode` system option. Like Formwork 1.13.0, by default HTML tags and dangerous link are escaped. Even if enabled by an administrator, however, `<script>` and other dangerous tags are still converted to text, but secure tags are allowed.Referenceshttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35621
CVSS v3.1: 4.8
CVE-2023-30746: WordPress Booqable Rental Plugin Plugin <= 2.4.15 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Booqable Rental Software Booqable Rental plugin <= 2.4.15 versions.
CVSS v3.1: 5.9
GHSA-45w9-c3q7-mccg: Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries
CVSS v3.1: 8.8
GHSA-f443-p4rq-r8h6: cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).
CVSS v3.0: 5.4
CVE-2008-3717: Harmoni before 1.6.0 does not require administrative privileges to list (1) user names or (2) asset ids, which allows remote attackers to obtain sensitive information.
CVSS v2.0: 5
GHSA-23wc-v4mf-x7v4: Directory Traversal in intsol-package
`intsol-package` is a file server.`intsol-package` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.**Example Request:**and the server's ResponseRecommendationNo patch is available for this vulnerability.It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
CVSS v3.0: 7.5
RHSA-2024:5607: Red Hat Security Advisory: libreoffice security update
libreoffice: Ability to trust not validated macro signatures removed in high security mode
CVSS v3.1: 7.8
CVE-2018-17953: pam_access does not handle netmask matches correctly
A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).
CVSS v3.0: 7.5
GHSA-95rm-cxp2-w27h: Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVE-2025-1268: Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / Generic FAX Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / PDF Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver
CVSS v3.1: 9.4
GHSA-3vg2-5h9w-8928: Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username (user) or (2) comment (commento) field, different vectors than CVE-2007-2357.
CVE-2019-6626: On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the Configuration utility.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2025-5791: Users: `root` appended to group listings
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
CVSS v3.1: 7.1
CVE-2024-6613: Incorrect listing of stack frames
The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.
CVSS v3.1: 5.5
CVE-2025-50065: Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Native Image).   The supported version that is affected is Oracle GraalVM for JDK: 24.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVSS v3.1: 3.7
GHSA-fw8m-f5g8-v52m: In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation (JSON) lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser.
CVSS v3.1: 8.8
CVE-2018-16967: There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
CVSS v3.0: 6.1
CVSS v2.0: 4.3