ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-rf28-mvmh-8r4j: Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18.1 and 18.2. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Core RDBMS executes to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Core RDBMS accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Core RDBMS. CVSS 3.0 Base Score 8.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H).
CVSS v3.0: 8.4
RHSA-2025:15904: Red Hat Security Advisory: container-tools:rhel8 security update
podman: Build Context Bind Mount podman: Podman kube play command may overwrite host files
CVSS v3.1: 8.1
CVE-2024-35762: WordPress Serious Slider plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Cryout Creations Serious Slider allows Stored XSS.This issue affects Serious Slider: from n/a through 1.2.4.
CVSS v3.1: 6.5
CVE-2017-16137: The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2025-8362: GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting (XSS).This issue affects GoogleTag Manager: from 0.0.0 before 1.10.0.
CVSS v3.1: 4.3
GHSA-xw4p-pw82-hqr7: OpenClaw's sandbox skill mirroring path traversal vulnerability could write outside the sandbox workspace
OverviewIn affected versions, OpenClaw’s sandbox skill mirroring used the skill’s frontmatter `name` as part of the destination path when copying skills into the sandbox workspace. A crafted skill name containing traversal segments (for example `../`) or an absolute path could cause the copy to write outside `<sandbox_workspace>/skills/`.ImpactFiles may be written outside the sandbox workspace root (within the permissions of the user running OpenClaw).Attack RequirementsAttacker can provide a skill package (controls `SKILL.md` frontmatter).Victim runs with sandbox enabled and skill mirroring into the sandbox workspace.Affected Packages / Versions`openclaw` (npm): `< 2026.2.14`Fixed In`openclaw` (npm): `>= 2026.2.14`Fix Commit(s)3eb6a31b6fcf8268456988bfa8e3637d373438c2OpenClaw thanks @1seal for reporting.
CVSS v4.0: 5.7
CVSS v3.1: 7.1
CVE-2026-26075: Cross-Site Request Forgery (CSRF) in FastGPT
FastGPT is an AI Agent building platform. Due to the fact that FastGPT's web page acquisition nodes, HTTP nodes, etc. need to initiate data acquisition requests from the server, there are certain security issues. In addition to implementing internal network isolation in the deployment environment, this optimization has added stricter internal network address detection. This vulnerability is fixed in 4.14.7.
CVSS v4.0: 6.9
CVE-2026-10719: Open Seachest/Seachest NVMe show Format Descriptors Vulnerability
Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writing 1 extra byte outside of allocated memory which sets a value to 1 via a maliciously crafted NVMe device with a bogus value in the namespace FLBAS byte.
CVSS v4.0: 1.8
GHSA-mxg3-45rj-wpf7: A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field.
CVSS v3.1: 6.1
GHSA-5mw9-5f6m-q724: In the Linux kernel, the following vulnerability has been resolved:net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattrIn mrp_pdu_parse_vecattr(), vector attribute events are encoded three
per byte and valen tracks the number of events left to process.The parser decrements valen after processing the first and second events
from each event byte, but not after processing the third one. When valen
is exactly a multiple of three, the loop continues after the last valid
event and consumes the next byte as a new event byte, applying a
spurious event to the MRP applicant state.Additionally, when valen is zero the parser unconditionally consumes
attrlen bytes as FirstValue and advances the offset, even though per
IEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of
zero and no FirstValue or Vector fields. This corrupts the offset for
subsequent PDU parsing.Also, when valen exceeds three the loop crosses byte boundaries but
the attribute value is not incremented between the last event of one
byte and the first event of the next. This causes the first event of
the next byte to use the same attribute value as the third event
rather than the next consecutive value.Decrement valen after processing the third event, skip FirstValue
consumption when valen is zero, and increment the attribute value at
the end of each loop iteration.
CVE-2015-5761: CoreText in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-5755.
CVSS v2.0: 6.8
GHSA-mc4m-5rw2-vpwv: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Templines TM Islamic Helper allows Reflected XSS.This issue affects TM Islamic Helper: from n/a through 1.0.1.
CVSS v3.1: 7.1
GHSA-rpx3-jhf4-259q: Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions.
CVSS v3.1: 8.8
CVE-2025-70842: A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authenticated administrator to upload crafted SVG files containing malicious JavaScript code. Once uploaded, the script executes in the browser of any user who accesses the direct URL of the image, including unauthenticated visitors.
CVSS v3.1: 5.4
GHSA-fr45-gqpr-4fc9: A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This issue affects some unknown processing of the file /WebPages/Adm/OperatorStop.asp of the component Reset Password Interface. The manipulation of the argument OperId leads to improper authorization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 6.3
CVSS v3.1: 3.7
RHSA-2008:0240: Red Hat Security Advisory: xpdf security update
xpdf: embedded font vulnerability
CVE-2024-23747: The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability resides in the system's handling of user data access through a /Modernanet/LAUDO/LAU0000100/Laudo?id= URI. By manipulating this id parameter, an attacker can gain access to sensitive medical information.
CVSS v3.1: 7.5
CVE-2017-0270: Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka "Windows SMB Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0271, CVE-2017-0274, CVE-2017-0275, and CVE-2017-0276.
CVSS v3.0: 5.9
CVSS v2.0: 4.3
GHSA-vjhq-vgwc-gxfm: tinyexr 0.9.5 has a heap-based buffer over-read via tinyexr::ReadChannelInfo in tinyexr.h.
CVSS v3.0: 9.8
GHSA-729m-hm3g-pgc3: When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions, bypassing Role-Based Access Control (RBAC).
CVSS v3.1: 4.1
GHSA-jw79-crqj-2vfw: Emerson ValveLink products 
use a fixed or controlled search path to find resources, but one or 
more locations in that path can be under the control of unintended 
actors.
CVSS v4.0: 5.9
CVSS v3.1: 5.1
GHSA-gv3v-2cpp-3pmq: Keycloak logs sensitive headers
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.Patches are available, see:https://github.com/keycloak/keycloak/releases/tag/26.4.11https://github.com/keycloak/keycloak/releases/tag/26.5.6https://github.com/keycloak/keycloak/releases/tag/26.6.0
CVSS v3.1: 5
GHSA-r8m6-4m9c-fg6x: Cervantes through 0.5-alpha accepts insecure file uploads.
CVSS v3.1: 5.4
CVE-2019-20493: cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-f4g4-cj8f-3cr9: OpenStack Nova logs sensitive context from notification exceptions
An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.
CVSS v3.0: 9.8
GHSA-wm5f-5px7-g28v: VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-7gcw-xvw2-3jf5: ASA 5515-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x before 9.2.4 Interim, ASA 5510 Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 8.4.x before 8.4.7 Interim, 8.2.x before 8.2.5 Interim, 9.1.x before 9.1.6 Interim, ASA 5555-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5512-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5520 Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 8.2.x before 8.2.5 Interim, 8.4.x before 8.4.7 Interim, 9.1.x before 9.1.6 Interim, ASA 5505 Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.2.x before 9.2.4 Interim, 8.4.x before 8.4.7 Interim, 9.1.x before 9.1.6 Interim, ASA 5525-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5512-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x before 9.2.4 Interim or 9.2.4.SMP, 9.1.x before 9.1.6 Interim, ASA 5545-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5585-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5540 Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 8.2.x before 8.2.5 Interim, 8.4.x before 8.4.7 Interim, 9.1.x before 9.1.6 Interim, ASA 5515-X Adaptive Security Appliance ASA for Application Centric Infrastructure (ACI) Device Package 1.2.4.x before 1.2.4.8, ASA 5555-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.2.x before 9.2.4 Interim or 9.2.4.SMP, 9.4.x before 9.4.1 Interim, 9.1.x before 9.1.6 Interim, ASA 5580 Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.1.x before 9.1.6 Interim, ASA 5585-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.2.x before 9.2.4 Interim, 9.4.x before 9.4.1 Interim, ASA 5525-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x before 9.2.4 Interim or 9.2.4.SMP, 9.1.x before 9.1.6 Interim, ASA 5545-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x before 9.2.4 Interim or 9.2.4.SMP. 9.1.x before 9.1.6 ASA does not check the source of the ARP request or GARP packets for addresses it performs NAT translation for under unspecified conditions.
CVSS v3.0: 8.1
CVE-2019-6859: A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2023-29211: org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki  13.10.11, 14.4.7, and 14.10.
CVSS v3.1: 10
CVE-2026-5977: Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wifiOff can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2019-19849: An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
CVSS v3.0: 8.8
GHSA-rw38-rxpw-pv7c: InCopy versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-93cr-637p-8r5m: Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.This is similar to, but not identical to CVE-2023-32526.
CVSS v3.1: 6.5
GHSA-jfgp-9fwr-x969: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CVSS v3.0: 7.5
GHSA-xf5w-5cjx-254f: cookiedecode function in PHP-Nuke 4.4 allows users to bypass authentication and gain access to other user accounts by extracting the authentication information from a cookie.
CVE-2025-52467: pgai secrets exfiltration via `pull_request_target`
pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. In particular, the GITHUB_TOKEN with write permissions for the repository, allowing an attacker to tamper with all aspects of the repository, including pushing arbitrary code and releases. This issue has been patched in commit 8eb3567.
CVSS v3.1: 9.1
CVE-2024-2565: PandaXGO PandaX File Extension upload.go unrestricted upload
A vulnerability was found in PandaXGO PandaX up to 20240310. It has been classified as critical. Affected is an unknown function of the file /apps/system/router/upload.go of the component File Extension Handler. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257064.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out()
In the Linux kernel, the following vulnerability has been resolved:

vrf: use RCU protection in l3mdev_l3_out()

l3mdev_l3_out() can be called without RCU being held:

raw_sendmsg()
 ip_push_pending_frames()
  ip_send_skb()
   ip_local_out()
    __ip_local_out()
     l3mdev_ip_out()

Add rcu_read_lock() / rcu_read_unlock() pair to avoid
a potential UAF.
CVSS v3.1: 7.8
GHSA-496r-7vwg-mwcf: Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.
CVSS v3.1: 7.1
CVE-2007-0492: Multiple SQL injection vulnerabilities in gallery.php in webSPELL 4.01.02 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) galleryID parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 7.5
CVE-2017-9184: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:314:7.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2021-20543: IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 198929.
CVSS v3.0: 5.4
CVE-2025-31284: A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. 

Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
CVSS v3.1: 4.6
GHSA-gmpc-fxg2-vcmq: AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin
SummaryThe TopMenu plugin renders menu item fields (icon classes, URLs, and text labels) directly into HTML without applying `htmlspecialchars()` or any other output encoding. Since menu items are rendered on every public page through plugin hooks, a single malicious menu entry results in stored cross-site scripting that executes for every visitor to the site. An admin user who is tricked into saving a crafted menu item (or an attacker who gains admin access) can compromise all site visitors.DetailsMultiple output locations in the TopMenu plugin render user-controlled data without escaping:In `HTMLMenuRight.php:24`, the icon class is injected directly:In `HTMLMenuRight.php:40`, the URL is rendered without encoding:In `HTMLMenuLeft.php:32`, same pattern for the left menu:In `index.php:49`, the menu item text is echoed raw:Menu item data is saved via `menuItemSave.json.php` with no sanitization in the setter methods. The stored values are loaded from the database and rendered on every page because the TopMenu plugin hooks into the global page layout.Critically, `menuItemSave.json.php` has no CSRF protection. It checks `User::isAdmin()` but does not call `isGlobalTokenValid()` or perform any other CSRF token validation. This means the stored XSS can be chained with CSRF: an attacker does not need a compromised admin account. Instead, a cross-origin POST from an attacker-controlled page can create the malicious menu item if an admin visits the attacker's page while logged in.Proof of ConceptAs an admin user, save a menu item with a malicious icon class:Alternatively, inject via the URL field to create a JavaScript link:Alternatively, inject via the text field:Alternatively, chain with CSRF (no admin account needed). Host this HTML on an attacker-controlled domain and lure an admin to visit it:The cross-origin POST creates the malicious menu item because `menuItemSave.json.php` has no CSRF token validation.Visit any page on the AVideo instance:The injected JavaScript executes in the context of every visitor's browser session because the menu is rendered on all pages.ImpactStored cross-site scripting on every page of the AVideo instance. An attacker can steal session cookies, redirect users to phishing pages, modify page content, or perform actions on behalf of authenticated users (including admins). Because the menu renders globally, a single injection point compromises all visitors to the site.Recommended FixApply `htmlspecialchars()` with `ENT_QUOTES` to all outputs of `$value2['finalURL']`, `$value2['icon']`, and `$menuItem->getText()` in the TopMenu plugin templates:Apply the same encoding to every location in `HTMLMenuRight.php`, `HTMLMenuLeft.php`, `floatMenu.php`, and `index.php` where these values are echoed into HTML.*Found by [aisafe.io](https://aisafe.io)*
CVSS v3.1: 6.1
GHSA-7hrq-m3jx-vxhp: A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/changeimage.php of the component Managecard Edit Image Page. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 4.7
GHSA-pw2v-hvc7-4w3q: Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access.
CVSS v4.0: 6.8
CVSS v3.1: 6.5
CVE-2013-1583: The dissect_version_4_primary_header function in epan/dissectors/packet-dtn.c in the DTN dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 accesses an inappropriate pointer, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVSS v2.0: 2.9
CVE-2021-25292: An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
RHBA-2022:5721: Red Hat Bug Fix Advisory: .NET 6.0 on RHEL 7 bugfix update
eventsource: Exposure of Sensitive Information
CVSS v3.1: 9.3
CVE-2019-25648: MyVideoConverter Pro 3.14 Denial of Service Buffer Overflow
MyVideoConverter Pro 3.14 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying an excessively long string to the registration code input field. Attackers can paste a malicious payload containing 10000 bytes into the 'Copy and Paste Registration Code' field to trigger a denial of service condition.
CVSS v4.0: 6.9
CVSS v3.1: 6.2