ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-52v4-p4vv-8fxm: Multiple unspecified vulnerabilities in Local Media Browser before 0.1 have unknown impact and attack vectors related to "Security holes."
GHSA-4793-w44w-m7xm: Plone Zope cross-site scripting (XSS) vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.
CVSS v4.0: 5.3
CVSS v3.1: 6.1
RHSA-2026:6310: Red Hat Security Advisory: kernel security update
kernel: Linux kernel: Use-after-free in BPF sockmap can lead to denial of service and privilege escalation kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem kernel: macvlan: fix possible UAF in macvlan_forward_source() kernel: macvlan: fix error recovery in macvlan_common_newlink()
CVSS v3.1: 7
CVE-2013-1010: WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
CVSS v2.0: 9.3
CVE-2024-33439: An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi parameters.
CVSS v3.1: 9.1
GHSA-x4j6-xvjv-qp6p: GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it.Upon receiving a UDP message,  the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:IP field stack overflowThe following code is vulnerable to a stack overflow that is attacker-controlled:
CVSS v3.1: 10
GHSA-wp8p-fcqc-823w: The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in admin perform such actions via CSRF attacks
CVSS v3.1: 8.8
CVE-2016-4824: The Wi-Fi Protected Setup (WPS) implementation on Corega CG-WLR300GNV and CG-WLR300GNV-W devices does not restrict the number of PIN authentication attempts, which makes it easier for remote attackers to obtain network access via a brute-force attack.
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2020-4953: IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's internal structure by exposing sensitive information in HTTP repsonses. IBM X-Force ID: 192029.
CVSS v3.0: 4.3
GHSA-pgcw-hp94-qc6c: Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allow an attacker to gain access to the device management page with admin privileges without proper authentication.
CVSS v3.0: 9.8
GHSA-fh3w-2r24-g9vx: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82736068.
CVSS v3.0: 7.8
GHSA-3244-vj38-xw85: A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/viewenquiry.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVE-2017-14541: XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .svg file, related to "Data from Faulting Address controls Branch Selection starting at CADImage+0x000000000001f23e."
CVSS v3.0: 7.8
CVSS v2.0: 4.6
CVE-2023-1593: SourceCodester Automatic Question Paper Generator System cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Automatic Question Paper Generator System 1.0. This issue affects some unknown processing of the file classes/Master.php?f=save_class. The manipulation of the argument description leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-223661 was assigned to this vulnerability.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-v4v5-73p4-rg59: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS v3.1: 7.5
CVE-2025-61594: URI Credential Leakage Bypass over CVE-2025-27221
URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
CVSS v4.0: 2.1
GHSA-4whv-v32x-qrpg: Eval injection vulnerability in the fillpdf_form_export_decode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via unspecified vectors.  NOTE: Some of these details are obtained from third party information.
CVE-2013-0354: Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5, and EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3, allows remote attackers to affect integrity via unknown vectors related to Policy Framework.
CVSS v2.0: 4.3
CVE-2014-1233: The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.
CVSS v2.0: 2.1
CVE-2019-3578: MyBB 1.8.19 has XSS in the resetpassword function.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2023-36536: 
 Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.

CVSS v3.1: 8.2
CVE-2023-45230: Buffer Overflow in EDK II Network Package
EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This
 vulnerability can be exploited by an attacker to gain unauthorized 
access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
CVSS v3.1: 8.3
GHSA-36wx-6wfq-226v: A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validation. This issue uniquely affects version 17.4.0; earlier software releases are not exposed.
CVSS v4.0: 7
CVSS v3.1: 6
CVE-2008-4821: Adobe Flash Player 9.0.124.0 and earlier, when a Mozilla browser is used, does not properly interpret jar: URLs, which allows attackers to obtain sensitive information via unknown vectors.
CVSS v2.0: 4.3
CVE-2022-25454: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the loginpwd parameter in the SetFirewallCfg function.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2022-23429: An improper boundary check in audio hal service prior to SMR Feb-2022 Release 1 allows attackers to read invalid memory and it leads to application crash.
CVSS v3.1: 5.3
CVE-2026-5167: Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint
The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handle_webhook() function. The webhook endpoint processes unauthenticated requests and only performs signature verification if both the webhook_secret setting is configured AND the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, the webhook processes attacker-controlled JSON payloads without any verification. This makes it possible for unauthenticated attackers to send fake Stripe webhook events with arbitrary order_id values in the metadata, mark any order as completed without payment, and gain unauthorized access to paid course content.
CVSS v3.1: 5.3
VA-25-120-01: Commvault Web Server unspecified vulnerability
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
CVSS v3.1: 8.8
CVE-2022-42055: Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system.
CVSS v3.1: 6.5
GHSA-q6cq-2jc2-cpx5: There is a heap-buffer-overflow at lit-strings.c:431 in lit_read_code_unit_from_utf8 in JerryScript 2.2.0.
GHSA-9v77-j4xv-34gq: A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
CVSS v3.1: 5.4
CVE-2023-0582: Path Traversal in ForgeRock Access Managment
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass.

This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2.
CVSS v3.1: 8.1
RHSA-2015:0217: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update
Security: Wrong security context loaded when using SAML2 STS Login Module RESTeasy: External entities expanded by DocumentProvider Management: Limited RBAC authorization bypass Subsystem: Information disclosure via incorrect sensitivity classification of attribute Weld: Limited information disclosure via stale thread state
GHSA-88pj-3r88-893v: A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
GHSA-m52f-gv7x-52q8: [PROBLEMTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [ATTACKER] to [IMPACT] via [VECTOR]
CVSS v3.1: 9.8
GHSA-xrmm-q45r-f6gr: Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.
CVSS v3.0: 8.8
GHSA-7ch9-34jx-wqhr: The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attackers (who can obtain a nonce from any public page containing a form) to upload executable PHP files to the publicly accessible /wp-content/uploads/de_fb_uploads/ directory and achieve Remote Code Execution by accessing the uploaded file via HTTP. The vulnerability was partially patched in version 5.1.3.
CVSS v3.1: 9.8
GHSA-9mjw-2qw9-2fvr: content/renderer/device_sensors/device_motion_event_pump.cc in Google Chrome before 41.0.2272.76 does not properly restrict access to high-rate accelerometer data, which makes it easier for remote attackers to capture keystrokes via a crafted web site that listens for ondevicemotion events, a different vulnerability than CVE-2015-1231.
CVE-2015-8106: Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-9hqq-vgv6-6grq: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Messenlehner of WebDevStudios WP-Announcements allows Reflected XSS. This issue affects WP-Announcements: from n/a through 1.8.
CVSS v3.1: 7.1
CVE-2025-62867: WordPress Ergonet Cache plugin <= 1.0.13 - Broken Access Control vulnerability
Missing Authorization vulnerability in ergonet Ergonet Cache ergonet-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ergonet Cache: from n/a through <= 1.0.13.
CVSS v3.1: 4.3
GHSA-fc5r-hmpv-2fcc: In Bluetooth, there is a possible service crash due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06126820; Issue ID: ALPS06126820.
GHSA-23q6-8qm4-482q: Digital Guardian Management Console 7.1.2.0015 has an XXE issue.
CVSS v3.0: 6.5
CVE-2006-5522: Multiple PHP remote file inclusion vulnerabilities in Johannes Erdfelt Kawf 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config parameter in (1) main.php or (2) user/account/main.php.
CVSS v2.0: 7.5
CVE-2012-3234: RealNetworks RealPlayer before 15.0.6.14, RealPlayer SP 1.0 through 1.1.5, and Mac RealPlayer before 12.0.1.1750 do not properly handle codec frame sizes in RealAudio files, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) or possibly have unspecified other impact via a crafted file.
CVSS v2.0: 7.5
GHSA-4pfr-7rwh-xm44: An information disclosure vulnerability in the kernel binder driver. Product: Android. Versions: Android kernel. Android ID A-36007193.
CVSS v3.0: 7.5
GHSA-wx53-3c9r-58r2: A stack-based buffer overflow in the Command Centre Server allows an attacker to cause a denial of service attack via assigning cardholders to an Access Group.This issue affects Command Centre: vEL8.80 prior to vEL8.80.1192 (MR2)
CVSS v3.1: 6.5
GHSA-jxf7-w6gg-cgmq: A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could be able to enumerate running RPC services. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
GHSA-7xx3-m584-x994: A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
Keepalive thread overload/DoSImpactA poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.PatchesThis vulnerability is patched in Puma 4.3.1 and 3.12.2.WorkaroundsReverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.For more informationIf you have any questions or comments about this advisory:Open an issue at [puma](github.com/puma/puma).
CVSS v3.1: 5.3
CVE-2005-2205: The ReadLog function in kaiseki.cgi in pngren allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.
CVSS v2.0: 7.5
CVE-2020-4554: IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183322.
CVSS v3.0: 7.8
GHSA-xq52-7mcc-4gqf: An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below could allow an attacker to escalate privileges by placing a custom crafted file in a specific directory to load a malicious library. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
CVE-2020-23226: Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-1999-1164: Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL headers, which causes Outlook to hang.
CVSS v2.0: 5
GHSA-8w5q-5fpq-v4pm: usememos/memos Cross-site Scripting vulnerability
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
CVSS v3.1: 9
GHSA-2q9m-cq5v-cp3v: SSH Tectia Management Agent 2.1.2 allows local users to gain root privileges by running a program called sshd, which is obtained from a process listing when the "Restart" action is selected from the Management server GUI, which causes the agent to locate the pathname of the user's program and restart it with root privileges.
GHSA-vg73-6hh6-2hpv: Dell PowerProtect DD versions prior to 7.10.1.50 and 7.13.1.20 contain a Stack-based Buffer Overflow vulnerability in the RestAPI. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
CVSS v3.1: 2.7
CVE-2019-18466: An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.
CVSS v3.1: 5.5
CVSS v2.0: 5.8
CVE-2012-6689: The netlink_sendmsg function in net/netlink/af_netlink.c in the Linux kernel before 3.5.5 does not validate the dst_pid field, which allows local users to have an unspecified impact by spoofing Netlink messages.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2023-43501: A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
CVSS v3.1: 6.5
CVE-2021-30868: A race condition was addressed with improved locking. This issue is fixed in macOS Monterey 12.0.1, macOS Big Sur 11.6.1. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS v3.1: 7
CVSS v2.0: 7.6
CVE-2023-22392: Junos OS: PTX Series and QFX10000 Series: Received flow-routes which aren't installed as the hardware doesn't support them, lead to an FPC heap memory leak

A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).

PTX3000, PTX5000, QFX10000, PTX1000, PTX10002, and PTX10004, PTX10008 and PTX10016 with LC110x FPCs do not support certain flow-routes. Once a flow-route is received over an established BGP session and an attempt is made to install the resulting filter into the PFE, FPC heap memory is leaked. The FPC heap memory can be monitored using the CLI command "show chassis fpc".

The following syslog messages can be observed if the respective filter derived from a flow-route cannot be installed.

expr_dfw_sfm_range_add:661 SFM packet-length Unable to get a sfm entry for updating the hw
expr_dfw_hw_sfm_add:750 Unable to add the filter secondarymatch to the hardware
expr_dfw_base_hw_add:52 Failed to add h/w sfm data.
expr_dfw_base_hw_create:114 Failed to add h/w data.
expr_dfw_base_pfe_inst_create:241 Failed to create base inst for sfilter 0 on PFE 0 for __flowspec_default_inet__
expr_dfw_flt_inst_change:1368 Failed to create __flowspec_default_inet__ on PFE 0
expr_dfw_hw_pgm_fnum:465 dfw_pfe_inst_old not found for pfe_index 0!
expr_dfw_bp_pgm_flt_num:548 Failed to pgm bind-point in hw: generic failure
expr_dfw_bp_topo_handler:1102 Failed to program fnum.
expr_dfw_entry_process_change:679 Failed to change instance for filter __flowspec_default_inet__.
This issue affects Juniper Networks Junos OS:

on PTX1000, PTX10002, and PTX10004, PTX10008 and PTX10016 with LC110x FPCs:



  *  All versions prior to 20.4R3-S5;
  *  21.1 versions prior to 21.1R3-S4;
  *  21.2 versions prior to 21.2R3-S2;
  *  21.3 versions prior to 21.3R3;
  *  21.4 versions prior to 21.4R2-S2, 21.4R3;
  *  22.1 versions prior to 22.1R1-S2, 22.1R2.




on PTX3000, PTX5000, QFX10000:



  *  All versions prior to 20.4R3-S8;
  *  21.1 version 21.1R1 and later versions;
  *  21.2 versions prior to 21.2R3-S6;
  *  21.3 versions prior to 21.3R3-S5;
  *  21.4 versions prior to 21.4R3-S4;
  *  22.1 versions prior to 22.1R3-S3
  *  22.2 versions prior to 22.2R3-S1
  *  22.3 versions prior to 22.3R2-S2, 22.3R3
  *  22.4 versions prior to 22.4R2.







CVSS v3.1: 6.5
GHSA-338p-3995-mggv: Multiple stack-based buffer overflows in Command EXEC in Cisco IOS allow local users to gain privileges via unspecified vectors, aka (1) PSIRT-0474975756 and (2) PSIRT-0388256465.  NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information.  However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVE-2020-28185: User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2023-7144: gopeak MasterLab HTTP POST Request Feature.php sqlInject sql injection
A vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10. This affects the function sqlInject of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249147.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 5.8
CVE-2006-4779: PHP remote file inclusion vulnerability in includes/functions_portal.php in Vitrax Premodded phpBB 1.0.6-R3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS v2.0: 7.5
GHSA-52cx-vphc-jmjm: MantisBT allows XSS in manage_custom_field_edit_page.php
An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
CVSS v3.1: 6.1
CVE-2006-0174: Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to obtain sensitive information (intranet IP addresses and enumerations of valid parameter values) via a direct request to hc, which reveals the information in an error message or a cookie.
CVSS v2.0: 4