ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2019-8811: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2013-3957: SQL injection vulnerability in the login screen in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0: 7.5
CVE-2026-22374: WordPress Zio Alberto theme <= 1.2.2 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Zio Alberto zioalberto allows PHP Local File Inclusion.This issue affects Zio Alberto: from n/a through <= 1.2.2.
CVSS v3.1: 8.1
CVE-2021-38963: IBM Aspera Console CSV injection
IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerability. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS v3.1: 8
GHSA-8hmm-7hr3-m5wg: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/manage_invoice&id= // Leak place ---> id.
CVSS v3.1: 9.8
CVE-2017-17625: Professional Service Script 1.0 has SQL Injection via the service-list city parameter.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2023-51628: D-Link DCS-8300LHV2 ONVIF SetHostName Stack-Based Buffer Overflow Remote Code Execution Vulnerability
D-Link DCS-8300LHV2 ONVIF SetHostName Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the handling of the SetHostName ONVIF call. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21322.
CVSS v3.0: 8
CVE-2006-6340: keystone.exe in nVIDIA nView allows attackers to cause a denial of service via a long command line argument.  NOTE: it is not clear whether this issue crosses security boundaries. If not, then this is not a vulnerability.
CVSS v2.0: 5
CVE-2019-10424: Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2004-0288: Buffer overflow in the UdmDocToTextBuf function in mnoGoSearch 3.2.13 through 3.2.15 could allow remote attackers to execute arbitrary code by indexing a large document.
CVSS v2.0: 10
CVE-2025-60126: WordPress Testimonial Slider Plugin <= 3.5.8.6 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginOps Testimonial Slider testimonial-add allows PHP Local File Inclusion.This issue affects Testimonial Slider: from n/a through <= 3.5.8.6.
CVSS v3.1: 8.8
GHSA-6fjw-6q9r-mr29: Cross-site scripting (XSS) vulnerability in IBM Informix Open Admin Tool (OAT) 2.x and 3.x before 3.11.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
GHSA-xrgf-r9gr-jjjf: Duplicate Advisory: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-vfp4-8x56-j7c5. This link is maintained to preserve external references.Original DescriptionOpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-risk interpreter startup variables including VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. Attackers can exploit this by manipulating these environment variables to influence downstream execution behavior or network connectivity.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-838r-w3fq-8qqq: Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker with local unprivileged access on a Windows system to elevate privileges via argument injection.
CVSS v3.1: 7.8
CVE-2021-33623: The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
CVSS v3.1: 7.5
CVSS v2.0: 5
RHSA-2024:1304: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion
CVSS v3.1: 5.5
CVE-2024-21871: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v4.0: 7.3
CVSS v3.1: 7.5
GHSA-9cgv-w9j2-3763: SeoToaster Ecommerce 3.0.0 contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files by manipulating path parameters in backend theme endpoints. Attackers can send POST requests to /backend/backend_theme/editcss/ or /backend/backend_theme/editjs/ with directory traversal sequences in the getcss or getjs parameters to retrieve file contents.
CVSS v4.0: 6.8
CVSS v3.1: 5.5
CVE-2025-32350: In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-prmp-jcjw-8ffg: Multiple cross-site scripting (XSS) vulnerabilities in the guestbook module in modules.php in Phanatic Softwares Chimera Web Portal System 0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) comment_poster, (2) comment_poster_email, (3) comment_poster_homepage, and (4) comment_text parameters.
GHSA-x8cr-2673-6pfx: The Dress Up! Girl Party (aka com.sgn.DressUp.GirlParty) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2011-4342: PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter.
CVSS v2.0: 7.5
GHSA-q99w-xr78-49hh: A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes Functionality of REDCap 11.2.5 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator.
CVSS v3.1: 9
GHSA-mhhp-c3cm-2r86: Test code in published microsoft-graph-core package exposes phpinfo()
ImpactThe Microsoft Graph Core PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php.  The phpInfo function exposes system information.The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function.This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application’s /vendor directory web accessible.The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data.PatchesThis problem has been patched in version 2.0.2.WorkaroundsIf an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds:delete the vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php fileremove access to the /vendor directory will remove this vulnerabilitydisable the phpinfo functionReferencesFor more information about the vulnerability and the patch, users can refer to the following sources:https://nvd.nist.gov/vuln/detail/CVE-2023-49103https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
CVSS v3.1: 5.4
RHSA-2026:13831: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
busybox: BusyBox: Arbitrary file overwrite and potential code execution via incomplete path sanitization busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
CVSS v3.1: 7
GHSA-9px9-grv9-rcf6: A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file fetch_data.php. The manipulation of the argument username/city leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252782 is the identifier assigned to this vulnerability.
CVSS v3.1: 3.5
CVE-2014-0413: Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0426.
CVSS v2.0: 4.3
CVE-2025-59432: Timing Attack Vulnerability in SCRAM Authentication
SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.
CVSS v4.0: 6.6
GHSA-j69j-c696-vxxx: A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file flights.php. The manipulation of the argument departure_airport_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273625 was assigned to this vulnerability.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-vfj2-rmjm-7969: The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access restrictions and possibly have other unspecified impact.
RHSA-2020:3005: Red Hat Security Advisory: Red Hat Integration Debezium 1.1.3 security update
postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML
CVSS v3.1: 7.7
GHSA-xwpx-xxx9-g4xw: The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the plugin utilizing fpdi-protection and not preventing direct access to test files that have display_errors set to true. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS v3.1: 5.3
CVE-2024-38157: Azure IoT SDK Remote Code Execution Vulnerability
Azure IoT SDK Remote Code Execution Vulnerability
CVSS v3.1: 7
GHSA-5p8h-f8cp-mr9j: An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (buffer overflow) via a crafted app.
CVSS v3.0: 7.8
CVE-2026-9795: Keycloak: keycloak: privilege escalation via improper scope mapping enforcement
A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.
CVSS v3.1: 7.3
CVE-2024-7453: FastAdmin Attachment Management Section 4 cross site scripting
A vulnerability was found in FastAdmin 1.5.0.20240328. It has been declared as problematic. This vulnerability affects unknown code of the file /[admins_url].php/general/attachment/edit/ids/4?dialog=1 of the component Attachment Management Section. The manipulation of the argument row[url]/row[imagewidth]/row[imageheight] leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273544.
CVSS v4.0: 5.1
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
CVE-2024-37412: WordPress Blossom Shop theme <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Blossom Shop blossom-shop allows Cross Site Request Forgery.This issue affects Blossom Shop: from n/a through <= 1.1.7.
CVSS v3.1: 4.3
CVE-2018-20827: The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
CVE-2025-64760: Tuleap has missing CSRF protections in its tracker trigger management system
Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763126988 and Tuleap Enterprise Edition prior to 17.0-3 and 16.13-8 have missing CSRF protections which allow attackers to create or remove tracker triggers. This issue is fixed in Tuleap Community Edition version 17.0.99.1763126988 and Tuleap Enterprise Edition versions 17.0-3 and 16.13-8.
CVSS v3.1: 4.6
GHSA-vpjc-79v8-48cm: K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.exe.
CVSS v3.1: 7.8
GHSA-vq5p-p2gc-wrvp: In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10320471; Issue ID: MSV-5536.
CVSS v3.1: 6.7
CVE-2025-24639: WordPress Korea for WooCommerce plugin <= 1.1.11 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Greys Korea for WooCommerce korea-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Korea for WooCommerce: from n/a through <= 1.1.11.
CVSS v3.1: 6.5
GHSA-w2xf-42w4-qqrc: An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).If an SRX Series device receives specific valid traffic destined to the device, it will cause the PFE to crash and restart.  Continued receipt and processing of this traffic will create a sustained DoS condition.This issue affects Junos OS on SRX Series:21.4 versions before 21.4R3-S7.9,22.1 versions before 22.1R3-S5.3,22.2 versions before 22.2R3-S4.11,22.3 versions before 22.3R3,22.4 versions before 22.4R3.Junos OS versions prior to 21.4R1 are not affected by this issue.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-mvwm-4jfh-22gx: The Windows Installer service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a custom action script associated with a .msi package, aka "Windows Installer EoP Vulnerability."
GHSA-gxqp-qgph-629x: Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 6.1
GHSA-cg6g-9fch-922g: Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
CVSS v3.1: 6.1
GHSA-q4vw-gxhg-p49c: SQL injection vulnerability in viewpost.php in mBlogger 1.0.04 allows remote attackers to execute arbitrary SQL commands via the postID parameter.
CVE-2015-4943: IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions, a different vulnerability than CVE-2015-4942.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-c6hq-jgwh-gh8x: Windows NTFS Remote Code Execution Vulnerability
CVSS v3.1: 7.8
CVE-2025-22721: WordPress ApplyOnline plugin <= 2.6.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Farhan Noor ApplyOnline apply-online allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline: from n/a through <= 2.6.7.1.
CVSS v3.1: 4.3
GHSA-jff3-2vxf-7gwc: Buffer overflow in Oracle9iAS Web Cache 2.0.0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request.
GHSA-wc23-543f-rmp8: Savsoft Quiz 6.0 allows stored XSS via the index.php/quiz/insert_quiz/ quiz_name parameter.
CVSS v3.1: 6.1
GHSA-3j9x-hj5x-f35c: A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/system.html. The manipulation of the argument uploadedFile with the input ;whoami leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
RHSA-2015:2393: Red Hat Security Advisory: wireshark security, bug fix, and enhancement update
wireshark: SigComp dissector crash (wnpa-sec-2014-20) wireshark: AMQP dissector crash (wnpa-sec-2014-21) wireshark: NCP dissector crashes (wnpa-sec-2014-22) wireshark: NCP dissector crashes (wnpa-sec-2014-22) wireshark: TN5250 infinite loop (wnpa-sec-2014-23) wireshark: DEC DNA Routing Protocol dissector crash (wnpa-sec-2015-03) wireshark: SMTP dissector crash (wnpa-sec-2015-04) wireshark: TLS/SSL decryption crash (wnpa-sec-2015-05) wireshark: The WCP dissector could crash while decompressing data (wnpa-sec-2015-07) wireshark: The pcapng file parser could crash (wnpa-sec-2015-08) wireshark: The TNEF dissector could go into an infinite loop on 32-bit architectures (wnpa-sec-2015-10) wireshark: crash on sample file genbroad.snoop wireshark: WebSocket DoS (wnpa-sec-2015-13) wireshark: WCP dissector crash (wnpa-sec-2015-14) wireshark: X11 memory leak (wnpa-sec-2015-15) wireshark: Reassembly memory leak (wnpa-sec-2015-16) wireshark: Dissector table crash (wnpa-sec-2015-23) wireshark: ZigBee dissector crash (wnpa-sec-2015-24) wireshark: GSM RLC/MAC dissector infinite loop (wnpa-sec-2015-25) wireshark: WaveAgent dissector crash (wnpa-sec-2015-26) wireshark: Ptvcursor crash (wnpa-sec-2015-28)
GHSA-rgfg-vq4v-wjqp: WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.
CVE-2025-50009: WordPress Kata Plus plugin <= 1.5.3 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Climax Themes Kata Plus kata-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kata Plus: from n/a through <= 1.5.3.
CVSS v3.1: 5.4
GHSA-j3mh-qmjj-xp83: Ray Dashboard is vulnerable to path traversal through its static file handling mechanism
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-rcxj-mr3c-5q6h: The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet. Disclosure of secrets or other system settings is not affected as well as other spreadsheets still work as expected.
CVSS v3.1: 6.1
RHSA-2014:0799: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 update
CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy CXF: HTML content posted to SOAP endpoint could cause OOM errors CXF: Large invalid content could cause temporary space to fill JAX-RS: Information disclosure via XML eXternal Entity (XXE)
GHSA-hp9r-wcfh-72pr: A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.
CVSS v3.1: 7.8
GHSA-cc2q-7r88-56q9: The WebSocket backend uses charging station identifiers to uniquely 
associate sessions but allows multiple endpoints to connect using the 
same session identifier. This implementation results in predictable 
session identifiers and enables session hijacking or shadowing, where 
the most recent connection displaces the legitimate charging station and
 receives backend commands intended for that station. This vulnerability
 may allow unauthorized users to authenticate as other users or enable a
 malicious actor to cause a denial-of-service condition by overwhelming 
the backend with valid session requests.
CVSS v4.0: 6.9
CVSS v3.1: 7.3