ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2018-16192: Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same network segment to obtain information registered on the device via unspecified vectors.
CVSS v3.0: 6.5
CVSS v2.0: 3.3
CVE-2005-3405: ATutor 1.4.1 through 1.5.1-pl1 allows remote attackers to execute arbitrary PHP functions via a direct request to forum.inc.php with a modified addslashes parameter with either the (1) asc or (2) desc parameters set, possibly due to an eval injection vulnerability.
CVSS v2.0: 7.5
CVE-2014-2590: The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (interface outage) via crafted HTTP packets.
CVSS v2.0: 5
GHSA-5cxr-68fg-mvjv: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘loc_filter’ parameter.
CVSS v3.1: 8.8
CVE-2007-1377: AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service (unspecified resource consumption) via a .pdf URL with an anchor identifier that begins with search= followed by many %n sequences, a different vulnerability than CVE-2006-6027 and CVE-2006-6236.
CVSS v2.0: 5
CVE-2018-13996: Genann through 2018-07-08 has a stack-based buffer over-read in genann_train in genann.c.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-qpmg-vjr8-h687: Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) various input fields, including the contact, lead, and first or last name fields, (2) the record parameter in a DetailView action in the Leads module for index.php, (3) the $_SERVER['PHP_SELF'] variable, which is used in multiple locations such as index.php, and (4) aggregated RSS feeds in the RSS aggregation module.
RHSA-2026:5971: Red Hat Security Advisory: Satellite 6.16.7 Async Update
Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS Django: Django: Denial of Service via crafted request with duplicate headers crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption rubyipmi: Red Hat Satellite: Remote Code Execution in rubyipmi via malicious BMC username Django: Django: SQL Injection via RasterField band index parameter Django: Django: Denial of Service via crafted HTML inputs Django: Django: SQL Injection via crafted column aliases Django: Django: SQL injection via crafted column aliases in QuerySet.order_by() fog-kubevirt: fog-kubevirt: Man-in-the-Middle vulnerability due to disabled certificate validation foreman-kubevirt: foreman_kubevirt: Man-in-the-Middle due to insecure default SSL verification forman: Foreman: Remote Code Execution via command injection in WebSocket proxy
CVSS v3.1: 8
CVE-2024-56828: File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the base64-encoded image is parsed. For example, given a string like: data:image/html;base64,PGh0bWw+PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPjwvaHRtbD4= the content after the comma is extracted and decoded using Base64.getDecoder().decode(). The substring from the 11th character up to the first occurrence of a semicolon (;) is assigned to the suffix variable (representing the file extension). The decoded content is then written to a file. However, the file extension is not validated, and since this functionality is exposed to the frontend, it poses significant security risks.
CVSS v3.1: 9.8
GHSA-53j9-5hmj-8v9f: Infoblox NIOS through 8.6.4 has Improper Authentication for Grids.
CVSS v3.1: 9.8
CVE-2024-51846: WordPress Community Yard Sale plugin <= 1.1.11 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Simpson Community Yard Sale community-yard-sale allows Stored XSS.This issue affects Community Yard Sale: from n/a through <= 1.1.11.
CVSS v3.1: 6.5
GHSA-5p9r-p6jh-jxvh: The Symantec Messaging Gateway can encounter a file inclusion vulnerability, which is a type of vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. This file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application.
CVSS v3.0: 6.6
GHSA-qhpc-759w-4g4q: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_to_delete parameter. Attackers can send crafted requests with malicious SQL statements in the id_to_delete field to extract or modify sensitive database information.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
CVE-2024-51809: WordPress Keymaster Chord Notation Free plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in intelligentDesign Keymaster Chord Notation Free keymaster-chord-notation-free allows Stored XSS.This issue affects Keymaster Chord Notation Free: from n/a through <= 1.0.2.
CVSS v3.1: 6.5
GHSA-32q4-86g8-6637: Stored Cross Site Scripting in beetl-bbs
A Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameter.
CVSS v3.1: 5.4
GHSA-grgf-j3jj-cqpj: Cross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the returned suggestions.
CVE-2024-45508: HTMLDOC before 1.9.19 has an out-of-bounds write in parse_paragraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only node.
CVSS v3.1: 9.8
CVE-2020-4487: IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181862.
CVSS v3.0: 4.3
GHSA-mr8g-2mj4-pcq2: Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Impact`POST /two-factor` had no rate limiting, lockout, or attempt counter. An attacker with valid credentials can submit unlimited TOTP guesses. The TOTP implementation accepts the current code plus one step on either side (`config/google2fa.php window=1`), so at any instant 3 of 1,000,000 codes are accepted.After a correct guess the attacker holds a fully authenticated session. If the instance is configured with 2FA in optional mode (`two_factor_enabled='1'`), the attacker can additionally disable 2FA via `POST /account/profile` with `two_factor_optin=0`. No OTP re-verification is required. The account is then accessible with the password alone on future logins. If 2FA is in required-for-all mode (`='2'`), the per-user opt-out path is closed and the impact stops at session-level account takeover. For an admin target, `POST /api/v1/users/two_factor_reset` additionally clears another user's 2FA secret.PatchesPatched in v8.6.0
CVSS v3.1: 5.9
GHSA-m97p-7pjw-xw7r: Itsourcecode Online Discussion Forum Project v.1.0.0 is vulnerable to Cross Site Scripting (XSS) via /bcc_forum/members/home.php.
CVSS v3.1: 5.4
GHSA-c333-fmq7-47x6: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the wifiTimeClose parameter in goform/setWifi.
CVSS v3.1: 5.6
CVE-2007-6589: The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.
CVSS v2.0: 4.3
GHSA-cxx8-7x7p-5ccv: ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.The specific flaw exists within the uploadSSL method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a denial-of-service condition on the system. Was ZDI-CAN-28503.
CVSS v3.0: 5.5
GHSA-4jhp-rg38-c7h7: An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a XML file, performs incorrect memory handling, leading to a heap-based buffer over-read in the "normalize line endings" feature.
CVSS v3.1: 6.5
CVE-2013-1008: WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
CVSS v2.0: 9.3
CVE-2009-0876: Sun xVM VirtualBox 2.0.0, 2.0.2, 2.0.4, 2.0.6r39760, 2.1.0, 2.1.2, and 2.1.4r42893 on Linux allows local users to gain privileges via a hardlink attack, which preserves setuid/setgid bits on Linux, related to DT_RPATH:$ORIGIN.
CVSS v2.0: 6.9
CVE-2007-4657: Multiple integer overflows in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to obtain sensitive information (memory contents) or cause a denial of service (thread crash) via a large len value to the (1) strspn or (2) strcspn function, which triggers an out-of-bounds read.  NOTE: this affects different product versions than CVE-2007-3996.
CVSS v2.0: 7.5
CVE-2023-51551: Foxit PDF Reader AcroForm Signature Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader AcroForm Signature Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Signature objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22003.
CVSS v3.0: 7.8
CVE-2016-4951: The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2013-2583: Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite and Server before 6.20.7 rev16, 6.22.0 before rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allow remote attackers to inject arbitrary web script or HTML via (1) a javascript: URL, (2) malformed nested SCRIPT elements, (3) a mail signature, or (4) JavaScript code within an image file.
CVSS v2.0: 4.3
CVE-2026-26709: code-projects Simple Gym Management System v1.0 is vulnerable to SQL Injection in /gym/trainer_search.php.
CVSS v3.1: 9.8
GHSA-6xv6-j448-ffr5: A maliciously crafted CATPART, STP, and MODEL file, when parsed in atf_dwg_consumer.dll, rose_x64_vc15.dll and libodxdll through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process.
CVSS v3.1: 8.8
RHSA-2011:0313: Red Hat Security Advisory: seamonkey security update
Mozilla recursive eval call causes confirm dialog to evaluate to true (MFSA 2011-02) Mozilla miscellaneous memory safety hazards (MFSA 2011-01) Mozilla CSRF risk with plugins and 307 redirects (MFSA 2011-10)
CVE-2024-22378: Incorrect default permissions in some Intel Unite(R) Client Extended Display Plugin software installers before version 1.1.352.157 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v4.0: 5.4
CVSS v3.1: 6.7
GHSA-9f3f-wv7r-qc8r: Pion DTLS's usage of random nonce generation with AES GCM ciphers risks leaking the authentication key
ImpactPion DTLS versions v1.0.0 through v3.0.10 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack".PatchesUpgrade to v3.1.1 or later. This version includes PR #796, which uses the 64-bit sequence number to populate the `nonce_explicit` part of the GCM nonce. This is according to best practice outlined in [RFC 9325 section 7.2.1](https://www.rfc-editor.org/rfc/rfc9325#section-7.2.1).v3.0.11 is a backport patch supporting Go v1.21WorkaroundsThere are no workarounds without upgrading to version v3.0.11, v3.1.1 or later.ReferencesCommit fixing the bug: https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f
Commit fixing the bug (backport): 90e241c
Pull request: #796
CVSS v3.1: 5.9
GHSA-4pm8-5w34-q28w: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form allows Phishing. This issue affects Integrations of Zoho CRM with Elementor form: from n/a through 1.0.7.
CVSS v3.1: 4.7
GHSA-x5x5-qg9q-2423: QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3664 and CVE-2015-3665.
GHSA-jpq3-xf27-5jf2: Prototype Pollution in safe-object2
All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.
CVSS v3.1: 9.8
RHSA-2011:0181: Red Hat Security Advisory: openoffice.org and openoffice.org2 security update
OpenOffice.org: directory traversal flaws in handling of XSLT jar filter descriptions and OXT extension files OpenOffice.org: Array index error by insecure parsing of broken rtf tables OpenOffice.org: Integer signedness error (crash) by processing certain RTF tags OpenOffice.org: Heap-based buffer overflow by processing *.doc files with WW8 list styles with specially-crafted count of list levels OpenOffice.org: Array index error by scanning document typography information of certain *.doc files OpenOffice.org: heap based buffer overflow when parsing TGA files
CVE-2007-4818: Multiple PHP remote file inclusion vulnerabilities in Txx CMS 0.2 allow remote attackers to execute arbitrary PHP code via a URL in the doc_root parameter to (1) addons/plugin.php, (2) addons/sidebar.php, (3) mail/index.php, or (4) mail/mailbox.php in modules/.
CVSS v2.0: 7.5
RHSA-2024:0756: Red Hat Security Advisory: runc security update
runc: file descriptor leak
CVSS v3.1: 8.6
CVE-2026-41430: Press vulnerable to reflected XSS on login redirection
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting redirects to internal URLs only.
CVSS v4.0: 1.3
RHSA-2020:4390: Red Hat Security Advisory: python-django security update
Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS Django: the behavior of the underlying HTMLParser leading to DoS Django: SQL injection possibility in key and index lookups for JSONField/HStoreField Django: Potential memory exhaustion in django.utils.encoding.uri_to_iri()
CVSS v3.0: 5.3
CVE-2024-46597: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS v3.1: 7.5
RHSA-2006:0580: Red Hat Security Advisory: kernel security update
security flaw security flaw security flaw security flaw security flaw security flaw security flaw
GHSA-2hxv-86mh-6c78: A flaw has been found in Shibby Tomato 1.28. The affected element is the function send of the file usr/sbin/miniupnpd of the component SUBSCRIBE Call Handler. This manipulation causes server-side request forgery. The attack may be initiated remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
RHSA-2021:4779: Red Hat Security Advisory: kernel-rt security and bug fix update
kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free
CVSS v3.1: 7.8
GHSA-xqv2-3vvq-qg6r: Hashicorp Boundary vulnerable to clickjacking
Hashicorp Boundary is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.
CVSS v3.1: 6.1
GHSA-3jch-9qgp-4844: Generated code can read and write out of bounds in safe code
Code generated by flatbuffers' compiler is `unsafe` but not marked as such.
See https://github.com/google/flatbuffers/issues/6627 for details.All users that use generated code by `flatbuffers` compiler are recommended to:not expose flatbuffer generated code as part of their public APIsaudit their code and look for any usage of `follow`, `push`, or any method that uses them
(e.g. `self_follow`).Carefuly go through the crates' documentation to understand which "safe" APIs are not
intended to be used.
CVSS v3.1: 9.8
GHSA-v8rp-cx63-ff49: Multiple SQL injection vulnerabilities in Enterprise Connector 1.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the messageid parameter in (1) send.php or (2) a delete action in messages.php.
GHSA-v686-hww2-hffw: In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
CVE-2025-11131: In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVSS v3.1: 7.5
GHSA-j2qg-p3cm-7qgh: Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change patch loading information resulting in the deletion of directory files and compromise of system functions when loading a patch.
CVSS v3.0: 9.1
GHSA-j3ww-xcqh-98r2: eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup (or factory reset).
GHSA-p6cp-w5h4-4h2m: Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices allow remote attackers to execute arbitrary code on the Baseboard Management Controller (BMC), as demonstrated by the (1) username or (2) password field in login.cgi.
GHSA-w8rr-m9g7-26pr: A Pointer Derefernce Vulnerbility exists GPAC 1.0.1 the gf_isom_box_size function, which could cause a Denial of Service (context-dependent).
CVSS v3.1: 5.5
GHSA-pq88-rh4g-43f6: A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1. A malicious iframe may use another website’s download settings.
CVE-2005-3482: Cisco 1200, 1131, and 1240 series Access Points, when operating in Lightweight Access Point Protocol (LWAPP) mode and controlled by 2000 and 4400 series Airespace WLAN controllers running 3.1.59.24, allow remote attackers to send unencrypted traffic to a secure network using frames with the MAC address of an authenticated end host.
CVSS v2.0: 5
CVE-2021-0877: Product: AndroidVersions: Android SoCAndroid ID: A-273754094
CVSS v3.1: 9.8
RHSA-2012:0116: Red Hat Security Advisory: kernel security and bug fix update
kernel: no access restrictions of /proc/pid/* after setuid program exec kernel: be2net: promiscuous mode and non-member VLAN packets DoS kernel: ext4: ext4_ext_insert_extent() kernel oops kernel: keys: NULL pointer deref in the user-defined key type
CVE-2025-48012: One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063
Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.
CVSS v3.1: 4.8
CVE-2017-2494: An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2023-23531: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
CVSS v3.1: 8.6
CVE-2025-26706: Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.07.
CVSS v3.1: 5.4
CVE-2018-20883: cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).
CVSS v3.0: 6.5
CVSS v2.0: 4
CVE-2024-31546: Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/damage/view_damage.php.
CVSS v3.1: 9.8
CVE-2024-23704: In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7
RHSA-2023:0166: Red Hat Security Advisory: dpdk security update
dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
CVSS v3.1: 8.6
GHSA-728f-qcc4-8q48: The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
GHSA-9w2v-pc9r-gpj4: The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call.
CVE-2013-1636: Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNews (com_jnews) component 8.0.1 for Joomla!, and CiviCRM 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3, allows remote attackers to inject arbitrary web script or HTML via the get-data parameter.
CVSS v2.0: 4.3