ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-hg7x-vp9f-fjh2: An Improper Privilege Management vulnerability [CWE-269] in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.
CVSS v3.1: 1.9
CVE-2023-48415: In Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
CVE-2024-32660: FreeRDP zgfx_decompress out of memory vulnerability
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CVSS v3.1: 7.5
GHSA-6mc2-pgj3-wf69: elitecms v1.01 is vulnerable to SQL Injection via /admin/add_sidebar.php.
CVSS v3.1: 9.8
GHSA-rw67-4595-c74r: ** DISPUTED ** An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security realm reference" implies "effectively unsecured." The vendor explicitly supports these unsecured configurations because they have valid use cases during development.
CVSS v3.1: 9.8
CVE-2024-5508: Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22267.
CVSS v3.0: 7.8
GHSA-w7qw-j374-vmgx: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
GHSA-h67j-5fr3-9g6q: A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to remote code execution in the vulnerable portion of the branch (deletedir). An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS v3.1: 9.1
CVE-2024-55500: Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.
CVSS v3.1: 8.8
CVE-2023-37943: Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.
CVSS v3.1: 5.9
PYSEC-2010-9: ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.
CVE-1999-1233: IIS 4.0 does not properly restrict access for the initial session request from a user's IP address if the address does not resolve to a DNS domain, aka the "Domain Resolution" vulnerability.
CVSS v2.0: 7.5
GHSA-h9vw-8427-h758: An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory.Due to this vulnerability, users with low privileges may gain administrative access to the system.This issue can also be exploited in Artifactory platforms with anonymous access enabled.
CVSS v3.1: 9
CVE-2024-25386: Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the format_logfile.pl file.
CVSS v3.1: 8.8
cisco-sa-ucm-dos-OO4SRYEf: Cisco Hosted Collaboration Mediation Fulfillment Denial of Service Vulnerability
A vulnerability in the Java Management Extensions (JMX) component of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system.

This vulnerability is due to an unsecured TCP/IP port. An attacker could exploit this vulnerability by accessing the port and restarting the JMX process. A successful exploit could allow the attacker to cause a DoS condition on an affected system.

Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-dos-OO4SRYEf ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-dos-OO4SRYEf"]
CVSS v3.1: 5.3
GHSA-jq34-jj88-v48g: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
CVSS v4.0: 5.3
CVSS v3.1: 6.5
CVE-2025-27447: CVE-2025-27447
The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victimâ€™s browser when an authenticated administrator clicks the link.
CVSS v3.1: 7.4
GHSA-hq4m-5hfj-8xjc: In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
CVSS v3.1: 7.5
GHSA-jgw3-wf4r-4f7m: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Double Free vulnerability exists in Audio Driver while opening a sound compression device.
CVSS v3.0: 7.8
CVE-2018-1220: EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. A remote attacker may potentially exploit this vulnerability to redirect genuine users to phishing websites with the intent of obtaining sensitive information from the users.
CVSS v3.0: 6.1
CVSS v2.0: 5.8
CVE-2026-24540: WordPress Integrate Google Drive plugin <= 1.5.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through <= 1.5.6.
CVSS v3.1: 5.4
CVE-2022-47485: In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVSS v3.1: 4.4
CVE-2024-45063: Multiple issues in ctl(4) CAM Target Layer
The function ctl_write_buffer incorrectly set a flag which resulted in a kernel Use-After-Free when a command finished processing.

Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root.  Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process.  A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.
CVSS v3.1: 9.8
GHSA-7xcm-v3rc-gjwq: The Cool Timeline (Horizontal & Vertical Timeline) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the ctl_save() function. This makes it possible for unauthenticated attackers to save field icons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
CVE-2025-66459: Lookyloo vulnerable to XSS due to unescaped error message passed to innerHTML
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.
CVSS v4.0: 5.3
RHSA-2015:0264: Red Hat Security Advisory: Red Hat Satellite IBM Java Runtime security update
JDK: privilege escalation via shared class cache JDK: Java CMS keystore provider potentially allows brute-force private key recovery JDK: Privilege escalation issue SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack OpenJDK: SubjectDelegator protection insufficient (JMX, 8029755) OpenJDK: Clone interfaces passed to proxy methods (Libraries, 8035009) OpenJDK: Bytecode verification does not prevent ctor calls to this() and super() (Hotspot, 8035119) JDK: unspecified vulnerability fixed in 6u81, 7u65 and 8u11 (Deployment) OpenJDK: RSA blinding issues (Security, 8031346) OpenJDK: Prevent instantiation of service with non-public constructor (Security, 8035004) OpenJDK: AtomicReferenceFieldUpdater missing primitive type check (Libraries, 8039520) OpenJDK: insufficient Diffie-Hellman public key validation (Security, 8037162) JDK: unspecified vulnerability fixed in 6u81, 7u65 and 8u11 (Deployment) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: insufficient permission checks when setting resource bundle on system logger (Libraries, 8041564) ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540) OpenJDK: DatagramSocket connected socket missing source check (Libraries, 8039509) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: insufficient ResourceBundle name check (Libraries, 8044274) JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) OpenJDK: CipherInputStream incorrect exception handling (Security, 8037846) ICU: font parsing OOB read (OpenJDK 2D, 8055489) OpenJDK: MulticastSocket NULL pointer dereference (Libraries, 8056264) ICU: font parsing OOB read (OpenJDK 2D, 8056276) OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555) JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update OpenJDK: phantom references handling issue in garbage collector (Hotspot, 8047125) JDK: unspecified vulnerability fixed in 6u91, 7u75 and 8u31 (Deployment) JDK: unspecified vulnerability fixed in 6u91, 7u75 and 8u31 (Deployment) OpenJDK: directory information leak via file chooser (Swing, 8055304) OpenJDK: incorrect context class loader use in RMI transport (RMI, 8055309) OpenJDK: DER decoder infinite loop  (Security, 8059485) OpenJDK: insufficient code privileges checks (JAX-WS, 8054367)
GHSA-rjjg-hgv6-h69v: Memory corruption in Tensorflow
ImpactThe implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory corruption. This is because the pybind11 glue code assumes that the argument is a tensor:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/python/tfe_wrapper.cc#L1361However, there is nothing stopping users from passing in a Python object instead of a tensor.The uninitialized memory address is due to a `reinterpret_cast`
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/python/eager/pywrap_tensor.cc#L848-L850Since the `PyObject` is a Python object, not a TensorFlow Tensor, the cast to `EagerTensor` fails.PatchesWe have patched the issue in 22e07fb204386768e5bcbea563641ea11f96ceb8 and will release a patch release for all affected versions.We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by members of the Aivul Team from Qihoo 360.
CVSS v4.0: 7.1
CVSS v3.1: 7.1
GHSA-j9fc-qr37-r7w7: On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one that they control, and then capturing the credentials that are sent there. This occurs because stored credentials are not automatically deleted upon that type of hostname change.
CVSS v3.0: 4.9
GHSA-mg67-hj6h-72h8: Cross-site request forgery (CSRF) vulnerability in bingo!CMS 1.2 and earlier allows remote attackers to hijack the authentication of other users for requests that modify configuration or change content via unspecified vectors.
CVSS v3.1: 6.5
GHSA-39j6-jjvv-95wr: Missing Authorization vulnerability in Melapress Melapress File Monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress File Monitor: from n/a before 2.2.0.
CVSS v3.1: 5.4
GHSA-699f-m7wm-gv75: stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration of Google Gimini 1.0 Pro with `HarmBlockThreshold.BLOCK_NONE` for `HarmCategory.HARM_CATEGORY_HATE_SPEECH` and `HarmCategory.HARM_CATEGORY_HARASSMENT` in `safety_settings` disables content protection. This allows malicious commands to be executed, such as reading sensitive file contents like `/etc/passwd`.
CVSS v3.0: 7.5
GHSA-p97h-v2qf-9878: Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel allows Object Injection. This issue affects Goodlayers Hostel: from n/a through 3.1.2.
CVSS v3.1: 9.8
GHSA-9vf8-v5m2-wmpf: WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4462.
CVE-2020-6470: Insufficient validation of untrusted input in clipboard in Google Chrome prior to 83.0.4103.61 allowed a local attacker to inject arbitrary scripts or HTML (UXSS) via crafted clipboard contents.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
RHSA-2012:1289: Red Hat Security Advisory: java-1.7.0-ibm security update
OpenJDK: AWT hardening fixes (AWT, 7163201) JDK: unspecified vulnerability fixed in 6u33 and 7u5 (Deployment) OpenJDK: beans ClassFinder insufficient permission checks (beans, 7162476) OpenJDK: fontmanager layout lookup code memory corruption (2D, 7143617) OpenJDK: SynthLookAndFeel application context bypass (Swing, 7143614) OpenJDK: insecure temporary file permissions (JRE, 7143606) OpenJDK: mutable repository identifiers in generated stub code (CORBA, 7143851) JDK: unspecified vulnerability fixed in 6u33 and 7u5 (Deployment) JDK: unspecified vulnerability fixed in 6u33 and 7u5 (Deployment) OpenJDK: insufficient invokespecial <init> verification (HotSpot, 7160757) OpenJDK: java.lang.invoke.MethodHandles.Lookup does not honor access modes (Libraries, 7165628) OpenJDK: beans MethodElementHandler insufficient permission checks (beans, 7194567) OpenJDK: beans insufficient permission checks, Java 7 0day (beans, 7162473)
GHSA-8cfc-95hv-9rqj: In the Linux kernel, the following vulnerability has been resolved:smb: server: fix use-after-free in smb2_open()The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is
dereferenced after rcu_read_unlock(), creating a use-after-free
window.
CVSS v3.1: 7.8
CVE-2025-53991: WordPress JetTricks plugin <= 1.5.4.1 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTricks jet-tricks allows Stored XSS.This issue affects JetTricks: from n/a through <= 1.5.4.1.
CVSS v3.1: 6.5
CVE-2003-0281: Buffer overflow in Firebird 1.0.2 and other versions before 1.5, and possibly other products that use the InterBase codebase, allows local users to execute arbitrary code via a long INTERBASE environment variable when calling (1) gds_inet_server, (2) gds_lock_mgr, or (3) gds_drop.
CVSS v2.0: 4.6
CVE-2025-62564: Microsoft Excel Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS v3.1: 7.8
CVE-2019-8255: Brackets versions 1.14 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2023-0440: Observable Discrepancy in healthchecks/healthchecks
Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6.
CVSS v3.0: 5.3
CVE-2013-3445: The firewall subsystem in Cisco Identity Services Engine has an incorrect rule for open ports, which allows remote attackers to cause a denial of service (CPU consumption or process crash) via a flood of malformed IP packets, aka Bug ID CSCug94572.
CVSS v2.0: 5
GHSA-6qm2-c6m9-24vc: Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5).
CVE-2017-18746: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects EX3700 before 1.0.0.64, EX3800 before 1.0.0.64, EX6000 before 1.0.0.24, EX6130 before 1.0.0.16, EX6400 before 1.0.1.60, EX7000 before 1.0.0.50, EX7300 before 1.0.1.60, and WN2500RPv2 before 1.0.1.46.
CVSS v3.0: 6.1
GHSA-cxm8-p7cm-8rf5: Buffer overflow in subsystem in Intel(R) CSME before version 12.0.35 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS v3.0: 9.8
CVE-2025-31765: WordPress GDPR Cookie Notice plugin <= 1.2.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in themeqx GDPR Cookie Notice gdpr-cookie-notice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR Cookie Notice: from n/a through <= 1.2.0.
CVSS v3.1: 5.3
CVE-2020-8698: Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-gphh-hmhf-jgcw: Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an integer overflow or wraparound vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
CVSS v3.1: 6.5
CVE-2025-23534: WordPress WPLingo plugin <= 1.1.2 - Arbitrary Content Deletion vulnerability
Missing Authorization vulnerability in Mark Winiarski WPLingo wplingo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLingo: from n/a through <= 1.1.2.
CVSS v3.1: 6.5
GHSA-3f53-58pp-pg79: A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS v3.1: 7.1
GHSA-c2ww-38j4-6r8m: Denial of service via crafting malicious link and sending it to a privileged user can cause Denial of Service in Kraftway 24F2XG Router firmware version 3.5.30.1118.
CVSS v3.0: 6.5
GHSA-q83h-4xvh-fc8w: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.
CVSS v3.1: 7.8
CVE-2022-43455: CVE-2022-43455
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to the service_start, service_stop, and service_restart modules of the software. This could allow an attacker to start, stop, or restart arbitrary services running on the server.


CVSS v3.1: 5.5
CVE-2026-10795: UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
CVSS v3.1: 8.1
GHSA-xqv9-qr76-hfq2: @elgentos/magento2-dev-mcp vulnerable to command injection
A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The name of the patch is aa1ffcc0aea1b212c69787391783af27df15ae9d. A patch should be applied to remediate this issue.
CVSS v4.0: 1.9
CVSS v3.1: 5.3
GHSA-gc8q-hv36-8qpc: Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names containing script or HTML markup. Attackers can inject malicious code that is stored and rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.
CVSS v4.0: 4.8
CVSS v3.1: 4.8
GHSA-72xv-7h5g-gfmj: SQL injection vulnerability in admin/index.php in Inmostore 4.0 allows remote attackers to execute arbitrary SQL commands via the Password field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-h552-rv29-f87f: The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug).
CVSS v3.0: 7.3
GHSA-92v3-w4rw-mfxf: Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.10.
CVSS v3.1: 4.3