ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-6jwp-vhch-qjpr: A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_info.json inside a collection ZIP is inserted into a YAML template via Go's text/template without escaping. An attacker providing a crafted collection ZIP can leverage literal double quotes and newlines in the hostname to break out of the YAML quoted string and inject a new mount remapping entry. When an analyst applies the generated remapping file with --remap, arbitrary VQL executes on their machine with NullACLManager (all permissions granted, unsandboxed).
CVSS v3.1: 7.8
GHSA-9qr5-85g4-f6rq: A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing an illegal string to the server-side interface via a script, resulting in a stack overflow.
CVSS v3.1: 8.8
GHSA-cfcv-q4qq-2ph4: CKEditor 4 vulnerabilities in versions <4.16.1
Details see:https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg  ( CVE-2021-32809 )Patch: https://github.com/pimcore/pimcore/pull/10032
GHSA-44pg-r8gr-j75x: A vulnerability in the anycast gateway feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a device to learn invalid Address Resolution Protocol (ARP) entries. The ARP entries are for nonlocal IP addresses for the subnet. The vulnerability is due to improper validation of a received gratuitous ARP (GARP) request. An attacker could exploit this vulnerability by sending a malicious GARP packet on the local subnet to cause the ARP table on the device to become corrupted. A successful exploit could allow the attacker to populate the ARP table with incorrect entries, which could lead to traffic disruptions.
CVE-2006-6891: Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt.
CVSS v2.0: 5
GHSA-8cx8-xmvm-66wj: tools/sample_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud (Amazon EC2) is configured, uses world-readable permissions for /etc/keystone/ec2rc, which allows local users to obtain access to EC2 services by reading administrative access and secret values from this file.
CVE-2006-7113: Unrestricted file upload vulnerability in P-News 2.0 allows remote attackers to upload and execute arbitrary files via an avatar file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 7.5
GHSA-h3qh-mvr3-r7x7: A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.
CVSS v3.1: 3.3
GHSA-r48p-vhgj-x8mm: Unvalidated redirects
Gitpod before 0.6.0 allows unvalidated redirects.
CVSS v3.1: 6.1
CVE-2007-0067: Unspecified vulnerability in the Lotus Domino Web Server 6.0, 6.5.x before 6.5.6, and 7.0.x before 7.0.3 allows remote attackers to cause a denial of service (daemon crash) via requests for URLs that reference certain files.
CVSS v2.0: 7.8
CVE-2018-1515: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5 and 11.1, under specific or unusual conditions, could allow a local user to overflow a buffer which may result in a privilege escalation to the DB2 instance owner. IBM X-Force ID: 141624.
CVSS v3.0: 7.4
CVE-2024-45246: Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element
Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element
CVSS v3.1: 7.3
CVE-2017-11471: IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-7735-w2jp-gvg6: Vanna prompt injection code execution
The Vanna library uses a prompt function to present the user with visualized results, it is possible to alter the prompt using prompt injection and run arbitrary Python code instead of the intended visualization code. Specifically - allowing external input to the library’s “ask” method with "visualize" set to True (default behavior) leads to remote code execution.
CVSS v4.0: 9.2
CVSS v3.1: 8.1
CVE-2017-13751: There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2017-11283: Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
RHSA-2016:0534: Red Hat Security Advisory: mariadb security and bug fix update
mysql: unspecified vulnerability related to Server:Partition (CPU October 2015) mysql: unspecified vulnerability related to Server:Partition (CPU October 2015) mysql: unspecified vulnerability related to Server:DDL (CPU October 2015) mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015) mysql: unspecified vulnerability related to Client programs (CPU October 2015) mysql: unspecified vulnerability related to Server:Types (CPU October 2015) mysql: unspecified vulnerability related to Server:Security:Privileges (CPU October 2015) mysql: unspecified vulnerability related to Server:SP (CPU October 2015) mysql: unspecified vulnerability related to Server:DML (CPU October 2015) mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015) mysql: unspecified vulnerability related to Server:Parser (CPU October 2015) mysql: unspecified vulnerability related to Server:DML (CPU October 2015) mysql: unspecified vulnerability related to Server:DML (CPU October 2015) mysql: unspecified vulnerability in subcomponent: Server: Options (CPU January 2016) mysql: unspecified vulnerability in subcomponent: Client (CPU January 2016) mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016) mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016) mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016) mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU January 2016) mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU January 2016) mysql: unspecified vulnerability in subcomponent: Server: UDF (CPU January 2016) mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU January 2016) mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016) mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU April 2016) mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016) mysql: ssl-validate-cert incorrect hostname check mysql: unspecified vulnerability in subcomponent: Server: Option (CPU July 2016)
CVSS v3.0: 7.5
GHSA-2pw8-r6j9-6vm6: A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
CVSS v3.1: 6.1
CVE-2005-0660: Multiple cross-site scripting (XSS) vulnerabilities in D-Forum 1.11 allows remote attackers to inject arbitrary web script or HTML via certain fields, as demonstrated using the page parameter in nav.php3.
CVSS v2.0: 4.3
CVE-2022-48330: A Huawei sound box product has an out-of-bounds write vulnerability. Attackers can exploit this vulnerability to cause buffer overflow. Affected product versions include:FLMG-10 versions FLMG-10 10.0.1.0(H100SP22C00).
CVSS v3.1: 8
RHSA-2019:2437: Red Hat Security Advisory: Red Hat Virtualization security update
sssd: improper implementation of GPOs due to too restrictive permissions rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled edk2: stack overflow in XHCI causing denial of service openssl: 0-byte record padding oracle cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
CVSS v3.1: 5.9
CVSS v3.0: 9.8
CVE-2017-5462: A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-mp8r-xpq2-p39p: SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'SessionID' cookie  in '/inc/connect/CONNECTION.ASP'.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-q8qr-v893-9jp2: Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input data potentially causing a GPU Reset condition.
CVSS v3.1: 6
CVE-2011-1050: Unspecified vulnerability in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors related to "converson of string encodings" and "inconsistencies in the handling of UTF8 sequences by the user interface."
CVSS v2.0: 10
CVE-2009-4828: Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an admin_created action.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 6.8
CVE-2013-4706: The SSH implementation on the D-Link Japan DWL-2100AP with firmware before R252JP-RC572 allows remote authenticated users to cause a denial of service (reboot) by leveraging login access.
CVSS v2.0: 6.3
GHSA-84pc-6j7w-65xg: Incorrect access control in the file_details.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allows attackers with editor privileges to access sensitive files via crafted requests.
CVSS v3.1: 6.5
CVE-2025-61750: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query).  Supported versions that are affected are 8.61 and  8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.1: 4.3
CVE-2018-0950: An information disclosure vulnerability exists when Office renders Rich Text Format (RTF) email messages containing OLE objects when a message is opened or previewed, aka "Microsoft Office Information Disclosure Vulnerability." This affects Microsoft Word, Microsoft Office. This CVE ID is unique from CVE-2018-1007.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-v7jm-88cg-6qwx: Unspecified vulnerability in Oracle Java SE 8u60 and Java SE Embedded 8u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVE-2018-8218: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows 10, Windows 10 Servers.
CVSS v3.0: 7.7
CVSS v2.0: 6.8
CVE-2025-5546: PHPGurukul Daily Expense Tracker System expense-reports-detailed.php sql injection
A vulnerability classified as critical was found in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /expense-reports-detailed.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2023-43072: 

Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI. A local possibly unauthenticated attacker could potentially exploit this vulnerability, leading to ability to execute arbritrary shell commands.


CVSS v3.1: 4.4
GHSA-w554-444w-32f7: Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP GET parameter called by DataLogView.php, EventsView.php and AlarmsView.php scripts.
CVSS v3.1: 9.8
GHSA-4hm3-rc3w-g6pc: Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable third-party packages such as Google.Protobuf, DynamicData, System.Runtime.CompilerServices.Unsafe, and others.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-2cvf-r9jm-4qm9: Ceilometer Prints Sensitive Configuration Data to Log
A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.
CVSS v4.0: 6.9
CVSS v3.0: 4
CVE-2010-3786: QuickLook in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Excel file.
CVSS v2.0: 6.8
CVE-2018-6128: Incorrect URL parsing in WebKit in Google Chrome on iOS prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-x7vr-7frv-2rrh: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.
CVSS v3.0: 7.8
CVE-2023-40655: Extension - mooj.org - Reflected XSS in Proforms Basic component for Joomla <= 1.6.0
A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.
CVSS v3.1: 6.1
CVE-2021-31451: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13089.
CVSS v3.0: 7.8
CVE-2021-1125: NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to corrupt program data.
CVSS v3.1: 4.1
GHSA-5chc-59gh-mmpx: A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/DomainStore.java deleteDomain function is affected for the /auth/v1/domains/ API interface.
CVSS v3.1: 7.5
GHSA-fmfc-9crx-hjfr: There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed.
CVE-2016-2419: media/libmedia/IDrm.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26323455.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-c2c9-x42h-79f4: Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
GHSA-6gg6-vw3j-g8pq: Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode.
CVSS v3.0: 7.8
CVE-2013-4953: SQL injection vulnerability in play.php in Top Games Script 1.2 allows remote attackers to execute arbitrary SQL commands via the gid parameter.
CVSS v2.0: 7.5
CVE-2025-23620: WordPress Captchelfie – Captcha by Selfie plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trof Captchelfie – Captcha by Selfie captchelfie-captcha-by-selfie allows Reflected XSS.This issue affects Captchelfie – Captcha by Selfie: from n/a through <= 1.0.7.
CVSS v3.1: 7.1
RHSA-2025:22883: Red Hat Security Advisory: thunderbird security update
firefox: thunderbird: Race condition in the Graphics component firefox: thunderbird: Mitigation bypass in the DOM: Core & HTML component firefox: thunderbird: Use-after-free in the Audio/Video component firefox: thunderbird: Spoofing issue in Firefox firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component firefox: thunderbird: Same-origin policy bypass in the DOM: Notifications component firefox: thunderbird: Mitigation bypass in the DOM: Security component firefox: thunderbird: Same-origin policy bypass in the DOM: Workers component firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component
CVSS v3.1: 6.1
CVE-2008-1266: Multiple buffer overflows in the web interface on the D-Link DI-524 router allow remote attackers to cause a denial of service (device crash) or possibly have unspecified other impact via (1) a long username or (2) an HTTP header with a large name and an empty value.
CVSS v2.0: 7.8
GHSA-q3xx-v678-8w29: A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3.
CVE-2022-36868: Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of the connected Bluetooth device.
CVSS v3.1: 5.9
GHSA-7jvx-f994-rfw2: materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input
All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as &lt;not-a-tag /&gt;) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when the user-input is provided to the autocomplete component.
CVSS v3.1: 5.4
GHSA-f7mf-8v49-37qx: In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .
CVSS v3.1: 7.3
CVE-2014-0468: Vulnerability in fusionforge in the shipped Apache configuration, where the web server may execute scripts that 
the users would have uploaded in their raw SCM repositories (SVN, Git, 
Bzr...). This issue affects fusionforge: before 5.3+20140506.
CVSS v3.1: 9.8
CVE-2023-48488: Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1: 5.4
GHSA-v33r-r6h2-8wr7: Kimai's API invoice endpoint missing customer-level access control (IDOR)
Summary`GET /api/invoices/{id}` only checks the role-based `view_invoice` permission but does not verify the requesting user has `access` to the invoice's customer. Any user with `ROLE_TEAMLEAD` (which grants `view_invoice`) can read all invoices in the system, including those belonging to customers assigned to other teams.Affected Code`src/API/InvoiceController.php` line 92-101:The web controller (`src/Controller/InvoiceController.php` line 304-307) correctly checks customer access:The `access` attribute in `CustomerVoter` (line 71-87) verifies team membership, but this check is entirely missing from the API endpoint.PoCTested against Kimai v2.50.0 (Docker: `kimai/kimai2:apache`).Setup:TeamA with CustomerA ("SecretCorp"), TeamB with CustomerB ("BobCorp")Bob is a teamlead in TeamB onlyAn invoice exists for SecretCorp (TeamA)Response (200 OK):Bob can also enumerate all invoices via `GET /api/invoices` — the list endpoint uses `setCurrentUser()` in the query but the single-item endpoint bypasses this entirely via Symfony ParamConverter.ImpactAny teamlead can read all invoices across the system regardless of team assignment. Invoice data typically contains sensitive financial information (amounts, customer details, payment terms). In multi-team deployments this breaks the intended data isolation between teams.Suggested FixAdd the customer access check to the API endpoint, matching the web controller:
CVSS v3.1: 6.5
CVE-2019-11281: RabbitMQ XSS attack
Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information.
CVSS v3.0: 2.4
CVE-2026-34776: Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
CVSS v3.1: 5.3
GHSA-pq8f-m2fp-4jv5: Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
GHSA-3jp8-9qj5-8cv3: The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
CVSS v3.1: 5.4