deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-60956
Published: 2025-10-06
Description: Cross Site Request Forgery (CSRF) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60957
Published: 2025-10-06
Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60958
Published: 2025-10-06
Description: Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60959
Published: 2025-10-06
Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60960
Published: 2025-10-06
Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60961
Published: 2025-10-06
Description: Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information, and possibly other unspecified impacts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60962
Published: 2025-10-06
Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information, and possibly other unspecified impacts.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60963
Published: 2025-10-06
Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60964
Published: 2025-10-06
Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, gain sensitive information, and possibly other unspecified impacts.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60965
Published: 2025-10-06
Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, gain sensitive information, and possibly other unspecified impacts.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60967
Published: 2025-10-06
Description: Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-60969
Published: 2025-10-06
Description: Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22
References: http://endrun.com; http://sonoma.com; https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE: CVE-2025-61766
Published: 2025-10-06
Description: Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a bucket using the `!=` comparator. This will result in PHP's call stack limit exceeding, and/or increased memory consumption, potentially leading to a denial of service. Version 1.0.0 contains a patch for the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/weirdgloop/mediawiki-extensions-Bucket/blob/ad704120a1660b5929fb5825db1cf85c9c77acf4/includes/Expression/MemberOfExpression.php#L34; https://github.com/weirdgloop/mediawiki-extensions-Bucket/commit/6f4a71d531cb802cdb991d2a4ca7bf8fb691defd; https://github.com/weirdgloop/mediawiki-extensions-Bucket/security/advisories/GHSA-r9f2-4jh3-659j
CVE: CVE-2025-61769
Published: 2025-10-06
Description: Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload .svg file that contains JavaScript code that is later being executed. Commit 052f9c4226b2c0014bcd857fec47677340b185b1 fixes the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/emlog/emlog/commit/052f9c4226b2c0014bcd857fec47677340b185b1; https://github.com/emlog/emlog/security/advisories/GHSA-rrf5-pv68-gpjf; https://github.com/emlog/emlog/security/advisories/GHSA-rrf5-pv68-gpjf
CVE: CVE-2025-61777
Published: 2025-10-06
Description: Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-200, CWE-284, CWE-306, CWE-306
References: https://github.com/FlagForgeCTF/flagForge/commit/e2121c5fb7a512a49dcd875812c944265fb1a846; https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-26rx-c53q-rjf9
CVE: CVE-2025-61778
Published: 2025-10-06
Description: Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our `akka.remote.dot-netty.tcp` transport and this would correctly enforce private key validation on the server-side of inbound connections. Akka.Remote, however, never asked the outbound-connecting client to present ITS certificate - therefore it's possible for untrusted parties to connect to a private key'd Akka.NET cluster and begin communicating with it without any certificate. The issue here is that for certificate-based authentication to work properly, ensuring that all members of the Akka.Remote network are secured with the same private key, Akka.Remote needed to implement mutual TLS. This was not the case before Akka.NET v1.5.52. Those who run Akka.NET inside a private network that they fully control or who were never using TLS in the first place are now affected by the bug. However, those who use TLS to secure their networks must upgrade to Akka.NET V1.5.52 or later. One patch forces "fail fast" semantics if TLS is enabled but the private key is missing or invalid. Previous versions would only check that once connection attempts occurred. The second patch, a critical fix, enforces mutual TLS (mTLS) by default, so both parties must be keyed using the same certificate. As a workaround, avoid exposing the application publicly to avoid the vulnerability having a practical impact on one's application. However, upgrading to version 1.5.52 is still recommended by the maintainers.
CWE: CWE-290, CWE-295, CWE-306
References: https://getakka.net/articles/remoting/security.html; https://github.com/akkadotnet/akka.net/pull/7847; https://github.com/akkadotnet/akka.net/pull/7851
CVE: CVE-2025-11342
Published: 2025-10-06
Description: A weakness has been identified in code-projects Online Course Registration 1.0. This impacts an unknown function of the file /admin/edit-course.php. Executing manipulation of the argument coursecode can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/ttttbm123/cve/issues/1; https://vuldb.com/?ctiid.327227
CVE: CVE-2025-11343
Published: 2025-10-06
Description: A security vulnerability has been detected in code-projects Student Crud Operation 3.3. Affected is an unknown function of the file delete.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/romatdibrohiksnov/vulndb.com/blob/main/Student%20Crud%20Operation%20In%20PHP%20Unauthenticated%20SQL%20Injection%20allows%20mass%20deletion%20in%20delete.php.md; https://vuldb.com/?ctiid.327228
CVE: CVE-2025-28129
Published: 2025-10-06
Description: Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://github.com/NullMinds/CVE-Hunting/blob/main/Hostel%20Management%20System%20in%20PHP/Clickjacking.pdf
CVE: CVE-2025-56382
Published: 2025-10-06
Description: A stored Cross-site scripting (XSS) vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8. An authenticated attacker can inject arbitrary web script or HTML via the 'Customer Name' parameter when creating or editing customer profiles. This malicious input is improperly sanitized before storage and subsequent rendering, leading to script execution in the browsers of users who view the affected customer details.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Auspicious-Rook/Vulnerability-Research/tree/main/CVE-2025-56382; https://preview.codecanyon.net/item/lims-stock-manager-pro-with-pos/full_screen_preview/22256829?_ga=2.22[PII_REDACTED]36[PII_REDACTED][PII_REDACTED][PII_REDACTED]116
CVE: CVE-2025-57515
Published: 2025-10-06
Description: A SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL commands via vulnerable input fields, enabling the execution of time-delay functions to infer database responses.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sanchitsahni/CVE-2025-57515/; https://github.com/sanchitsahni/CVE-2025-57515/blob/main/Uniclare%20Student%20Portal%20v2.pdf
CVE: CVE-2025-6985
Published: 2025-10-06
Description: The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse() and lxml.etree.XSLT() without any hardening measures. In lxml versions up to 4.9.x, external entities are resolved by default, allowing attackers to read arbitrary local files or perform outbound HTTP(S) fetches. In lxml versions 5.0 and above, while entity expansion is disabled, the XSLT document() function can still read any URI unless XSLTAccessControl is applied. This vulnerability allows remote attackers to gain read-only access to any file the LangChain process can reach, including sensitive files such as SSH keys, environment files, source code, or cloud metadata. No authentication, special privileges, or user interaction are required, and the issue is exploitable in default deployments that enable custom XSLT.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://huntr.com/bounties/cf78abbb-df3b-43de-b6ee-132b73ff8331
CVE: CVE-2025-11344
Published: 2025-10-06
Description: A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Handler. The manipulation results in Remote Code Execution. The attack may be performed from remote. Upgrading to version 8.24, 9.14 and 10.2 addresses this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-94, CWE-94
References: https://docu.ilias.de/go/blog/15821/882; https://vuldb.com/?ctiid.327229; https://vuldb.com/?id.327229
CVE: CVE-2025-11345
Published: 2025-10-06
Description: A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://docu.ilias.de/go/blog/15821/882; https://vuldb.com/?ctiid.327230; https://vuldb.com/?id.327230
CVE: CVE-2025-61984
Published: 2025-10-06
Description: ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)
CVSS Score: 3.6 (LOW)
CWE: CWE-159
References: https://marc.info/?l=openssh-unix-dev&m=[PII_REDACTED]2149&w=2; https://www.openssh.com/releasenotes.html#10.1p1; https://www.openwall.com/lists/oss-security/2025/10/06/1
CVE: CVE-2025-61985
Published: 2025-10-06
Description: ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVSS Score: 3.6 (LOW)
CWE: CWE-158
References: https://marc.info/?l=openssh-unix-dev&m=[PII_REDACTED]2149&w=2; https://www.openssh.com/releasenotes.html#10.1p1; https://www.openwall.com/lists/oss-security/2025/10/06/1
CVE: CVE-2025-11346
Published: 2025-10-06
Description: A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 is able to mitigate this issue. It is advisable to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://vuldb.com/?ctiid.327231; https://vuldb.com/?id.327231; https://vuldb.com/?submit.664892
CVE: CVE-2025-59447
Published: 2025-10-06
Description: The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials.
CVSS Score: 2.2 (LOW)
CWE: CWE-497
References: https://bishopfox.com/blog/advisories; https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home; https://shop.yosmart.com/pages/product-support
CVE: CVE-2025-59448
Published: 2025-10-06
Description: Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain sensitive information or tamper with the traffic to control affected devices. This affects YoLink Hub 0382, YoLink Mobile Application 1.40.41, and YoLink MQTT Broker. NOTE: The vendor states that the vulnerability described (related to insecure transmission) only impacts the legacy mobile application logic, not the Hub hardware or firmware. The Hub functions solely as a pass-through (transparent gateway) for LoRa wireless data and does not inspect or process the application layer data.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-319
References: https://bishopfox.com/blog/advisories; https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home; https://shop.yosmart.com/pages/product-support
CVE: CVE-2025-59449
Published: 2025-10-06
Description: The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to remotely operate affected devices if the attacker obtains the associated device IDs. Because YoLink device IDs are predictable, an attacker can exploit this to gain full control over any other YoLink user's devices.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863
References: https://bishopfox.com/blog/advisories; https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home; https://shop.yosmart.com/pages/product-support
CVE: CVE-2025-59450
Published: 2025-10-06
Description: The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: https://bishopfox.com/blog/advisories; https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home; https://shop.yosmart.com/pages/product-support
CVE: CVE-2025-59451
Published: 2025-10-06
Description: The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes.
CVSS Score: 3.5 (LOW)
CWE: CWE-863
References: https://bishopfox.com/blog/advisories; https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home; https://shop.yosmart.com/pages/product-support
CVE: CVE-2025-59452
Published: 2025-10-06
Description: The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-340
References: https://bishopfox.com/blog/advisories; https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home; https://shop.yosmart.com/pages/product-support
CVE: CVE-2025-43824
Published: 2025-10-06
Description: The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43824
CVE: CVE-2025-61768
Published: 2025-10-06
Description: KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF (Server-Side Request Forgery) vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially crafted SVG file containing an external image reference, causing the server to initiate an outgoing connection to an arbitrary external URL. This can lead to information disclosure or internal network probing. Version 1.3.15 contains a fix for the issue.
CWE: CWE-20, CWE-434, CWE-918
References: https://github.com/xuemian168/kuno/commit/804b2909c65b16ae2063d0f992e0711aa09475e2; https://github.com/xuemian168/kuno/releases/tag/v1.3.15; https://github.com/xuemian168/kuno/security/advisories/GHSA-4f5f-2c49-5mwm
CVE: CVE-2025-61774
Published: 2025-10-06
Description: PyVista provides 3D plotting and mesh analysis through an interface for the Visualization Toolkit (VTK). Version 0.46.3 of the PyVista Project is vulnerable to remote code execution via dependency confusion. Two pieces of code use`--extra-index-url`. But when `--extra-index-url` is used, pip always checks for the PyPI index first, and then the external index. One package listed in the code is not published in PyPI. If an attacker publishes a package with higher version in PyPI, the malicious code from the attacker controlled package may be pulled, leading to remote code execution and a supply chain attack. As of time of publication, a patched version is unavailable.
CWE: CWE-94
References: https://github.com/pyvista/pyvista/blob/c96e1ddbe707fb7d3eb574dc3336de1a946f14a1/.devcontainer/offscreen/oncreatecommand.sh#L4; https://github.com/pyvista/pyvista/blob/c96e1ddbe707fb7d3eb574dc3336de1a946f14a1/docker/slim.Dockerfile#L13; https://github.com/pyvista/pyvista/commit/aabfb3db2b0d4980de9e94e66272240efba4ed95
CVE: CVE-2025-34251
Published: 2025-10-07
Description: Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as root and, despite a “lockdown” check that disables adb shell, still permits adb push/pull and adb forward. Because adbd is privileged and the device’s USB port is exposed externally, an attacker with physical access can write an arbitrary file to a writable location and then overwrite the kernel’s uevent_helper or /proc/sys/kernel/hotplug entries via ADB, causing the script to be executed with root privileges.
CWE: CWE-269, CWE-288
References: https://www.nccgroup.com/research-blog/technical-advisory-tesla-telematics-control-unit-adb-auth-bypass/; https://www.tesla.com/; https://www.vulncheck.com/advisories/tesla-tcu-auth-bypass
CVE: CVE-2025-11347
Published: 2025-10-07
Description: A vulnerability was found in code-projects Student Crud Operation up to 3.3. This vulnerability affects the function move_uploaded_file of the file add.php of the component Add Student Page/Edit Student Page. Performing manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://code-projects.org/; https://github.com/romatdibrohiksnov/vulndb.com/tree/main/Student-Registration-Crud-Operation%20Unauthenticated%20Arbitrary%20File%20Upload%20leads%20to%20Remote%20Code%20Execution; https://vuldb.com/?ctiid.327232