deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54138
Published: 2025-07-22
Description: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajax_form.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without validation or allowlisting. This pattern introduces a latent Remote Code Execution (RCE) vector if an attacker can stage a file in this include path — for example, via symlink, development misconfiguration, or chained vulnerabilities. This is fixed in version 25.7.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81; https://github.com/librenms/librenms/pull/17990; https://github.com/librenms/librenms/releases/tag/25.7.0
CVE: CVE-2025-54140
Published: 2025-07-22
Description: pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated path traversal vulnerability exists in the /json/upload endpoint of pyLoad. By manipulating the filename of an uploaded file, an attacker can traverse out of the intended upload directory, allowing them to write arbitrary files to any location on the system accessible to the pyLoad process. This may lead to: Remote Code Execution (RCE), local privilege escalation, system-wide compromise, persistence, and backdoors. This is fixed in version 0.5.0b3.dev90.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/pyload/pyload/blob/df094db67ec6e25294a9ac0ddb4375fd7fb9ba00/src/pyload/webui/app/blueprints/json_blueprint.py#L109; https://github.com/pyload/pyload/commit/fc4b136e9c4e7dcbb8e467ae802cb2c3f70a71b0; https://github.com/pyload/pyload/security/advisories/GHSA-xqpg-92fq-grfg
CVE: CVE-2025-54141
Published: 2025-07-22
Description: ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and  1.2.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-79
References: https://github.com/viewvc/viewvc/commit/1dd84542c39b39e4a3f434db84a8ba3441d6a1e7; https://github.com/viewvc/viewvc/commit/5d7c76be07b77dce4ff631e9b866056344f11e84; https://github.com/viewvc/viewvc/issues/211
CVE: CVE-2025-7766
Published: 2025-07-22
Description: Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
CVSS Score: 8.0 (HIGH)
CWE: CWE-611
References: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM; https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-02
CVE: CVE-2025-8010
Published: 2025-07-22
Description: Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_22.html; https://issues.chromium.org/issues/430344952
CVE: CVE-2025-8011
Published: 2025-07-22
Description: Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_22.html; https://issues.chromium.org/issues/430572435
CVE: CVE-2025-43020
Published: 2025-07-22
Description: A potential command
injection vulnerability has been identified in the Poly Clariti Manager for
versions prior to 10.12.2. The vulnerability could allow a privileged user
to submit arbitrary input. HP has addressed the issue in the latest software update.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]1447-16/hbsbpy04037
CVE: CVE-2025-43021
Published: 2025-07-22
Description: A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the use and retrieval of the default password. HP has addressed the issue in the latest software update.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-1393
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]1447-16/hbsbpy04037
CVE: CVE-2025-43022
Published: 2025-07-22
Description: A potential SQL injection vulnerability has been identified in the Poly
Clariti Manager for versions prior to 10.12.1. The vulnerability could allow
a privileged user to execute SQL commands. HP has addressed the issue in
the latest software update.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]1447-16/hbsbpy04037
CVE: CVE-2025-43483
Published: 2025-07-23
Description: A potential security vulnerability has been
identified in the Poly Clariti Manager for versions prior to 10.12.1. The
vulnerability could allow the retrieval of hardcoded cryptographic keys. HP has
addressed the issue in the latest software update.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-321
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]1447-16/hbsbpy04037
CVE: CVE-2025-43484
Published: 2025-07-23
Description: A potential reflected cross-site scripting vulnerability has been
identified in the Poly Clariti Manager for versions prior to 10.12.1. The
website does not validate or sanitize the user input before rendering it in the
response. HP has addressed the issue in the latest software update.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]1447-16/hbsbpy04037
CVE: CVE-2025-43485
Published: 2025-07-23
Description: A potential security
vulnerability has been identified in the Poly Clariti Manager for versions
prior to 10.12.2. The vulnerability could potentially allow a privileged
user to retrieve credentials from the log files. HP has addressed the issue in
the latest software update.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-532
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]1447-16/hbsbpy04037
CVE: CVE-2025-43486
Published: 2025-07-23
Description: A potential stored cross-site scripting vulnerability has been
identified in the Poly Clariti Manager for versions prior to 10.12.1. The
website allows user input to be stored and rendered without proper
sanitization. HP has addressed the issue in the latest software update.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]1447-16/hbsbpy04037
CVE: CVE-2025-43487
Published: 2025-07-23
Description: A potential privilege escalation through Sudo vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The firmware flaw does not properly implement access controls. HP has addressed the issue in the latest software update.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-250
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]1447-16/hbsbpy04037
CVE: CVE-2025-43488
Published: 2025-07-23
Description: A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a bypass of the application's XSS filter by submitting untrusted characters. HP has addressed the issue in the latest software update.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]1447-16/hbsbpy04037
CVE: CVE-2025-43489
Published: 2025-07-23
Description: A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could deserialize untrusted data without validation. HP has addressed the issue in the latest software update.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-502
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]1447-16/hbsbpy04037
CVE: CVE-2025-54139
Published: 2025-07-23
Description: HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application. This is fixed in haxcms-nodejs version 11.0.13 and haxcms-php 11.0.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://github.com/haxtheweb/haxcms-nodejs/commit/777f9a7ff9675a160496f350d766df1f1f9b9b99; https://github.com/haxtheweb/haxcms-php/commit/708dc8518928fe307044e67bff8b0f397cfdd606; https://github.com/haxtheweb/issues/security/advisories/GHSA-54vw-f4xf-f92j
CVE: CVE-2025-54120
Published: 2025-07-23
Description: PCL (Plain Craft Launcher) Community Edition is a Minecraft launcher. In PCL CE versions 2.12.0-beta.5 to 2.12.0-beta.9, the login credentials used during the third-party login process are accidentally recorded in the local log file. Although the log file is not automatically uploaded or shared, if the user manually sends the log file, there is a risk of leakage. This is fixed in version 2.12.0-beta.10.
CWE: CWE-532
References: https://github.com/PCL-Community/PCL2-CE/commit/b72eaaef05c131958b0f03bd5e7c2464bbc2af4f; https://github.com/PCL-Community/PCL2-CE/security/advisories/GHSA-f3rx-h3cv-696g
CVE: CVE-2025-8060
Published: 2025-07-23
Description: A vulnerability has been found in Tenda AC23 16.03.07.52 and classified as critical. Affected by this vulnerability is the function sub_46C940 of the file /goform/setMacFilterCfg of the component httpd. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/Thir0th/Thir0th-CVE/blob/main/Tenda%20AC23_V16.03.07.52_has_a_stack_overflow.md; https://vuldb.com/?ctiid.317317; https://vuldb.com/?id.317317
CVE: CVE-2025-5753
Published: 2025-07-23
Description: The Valuation Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/commercial-real-estate-valuation-calculator/trunk/valuation-calculator.php#L386; https://plugins.trac.wordpress.org/changeset/3336105/; https://wordpress.org/plugins/commercial-real-estate-valuation-calculator/#developers
CVE: CVE-2025-5818
Published: 2025-07-23
Description: The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fip_get_image_options() function. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/featured-image-plus/trunk/inc/admin/block-editor/block-editor-actions.php#L166; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3331831%40featured-image-plus&new=3331831%40featured-image-plus&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6904f168-e06f-4f17-905b-a943a39dfbdb?source=cve
CVE: CVE-2025-6054
Published: 2025-07-23
Description: The YANewsflash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the 'yanewsflash/yanewsflash.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/yanewsflash/; https://www.wordfence.com/threat-intel/vulnerabilities/id/171fe5db-0b43-47ba-b215-87ce9d7b5095?source=cve
CVE: CVE-2025-6190
Published: 2025-07-23
Description: The Realty Portal – Agent plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the rp_user_profile() AJAX handler in versions 0.1.0 through 0.3.9. The handler reads the client-supplied meta key and value pairs from $_POST and passes them directly to update_user_meta() without restricting to a safe whitelist. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the wp_capabilities meta and grant themselves the administrator role.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/realty-portal-agent/trunk/includes/class-agent-process.php#L494; https://wordpress.org/plugins/realty-portal-agent/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b3adfe9e-ebdf-4a50-b60f-03a606a84ec0?source=cve
CVE: CVE-2025-6214
Published: 2025-07-23
Description: The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9. The route’s permission_callback only verifies that the requester is logged in, but fails to require any nonce or other proof of intent. This makes it possible for unauthenticated attackers to delete arbitrary user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/omnishop/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c936b8-3132-45e1-92ed-32ecdc9cbb1e?source=cve
CVE: CVE-2025-6215
Published: 2025-07-23
Description: The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally,  ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://wordpress.org/plugins/omnishop/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/12d465d2-cd89-476e-b70a-743151a23053?source=cve
CVE: CVE-2025-6261
Published: 2025-07-23
Description: The Fleetwire Fleet Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fleetwire_list shortcode in all versions up to, and including, 1.0.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3364591%40fleetwire-fleet-management&new=3364591%40fleetwire-fleet-management&sfp_email=&sfph_mail=; https://wordpress.org/plugins/fleetwire-fleet-management/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/7593b8b5-36c0-4c68-b1f2-d505fafc3328?source=cve
CVE: CVE-2025-7722
Published: 2025-07-23
Description: The Social Streams plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their user meta information in the update_user_meta() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their user type to that of an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-272
References: https://plugins.trac.wordpress.org/browser/social-streams/trunk/src/php/JsonAPI.php#275; https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f01b88-6f93-4ee8-8d59-9165ebcd4dd1?source=cve
CVE: CVE-2025-42947
Published: 2025-07-23
Description: SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on confidentiality of the application.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94
References: https://me.sap.com/notes/3540688; https://url.sap/sapsecuritypatchday
CVE: CVE-2024-53286
Published: 2025-07-23
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to execute arbitrary code via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_16
CVE: CVE-2024-53287
Published: 2025-07-23
Description: Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_16
CVE: CVE-2024-53288
Published: 2025-07-23
Description: Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_16
CVE: CVE-2025-43881
Published: 2025-07-23
Description: Improper validation of specified quantity in input issue exists in Real-time Bus Tracking System versions prior to 1.1. If exploited, a denial of service (DoS) condition may be caused by an attacker who can log in to the administrative page of the affected product.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1284
References: https://jvn.jp/en/jp/JVN21177718/; https://www.synck.com/downloads/cgi-perl/buslocationsystem/index.html
CVE: CVE-2025-8020
Published: 2025-07-23
Description: All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code.
CVSS Score: 8.2 (HIGH)
CWE: CWE-918
References: https://gist.github.com/lirantal/ed18a4493ca9fe4429957c79454a9df1; https://security.snyk.io/vuln/SNYK-JS-PRIVATEIP-9510757; https://security.snyk.io/vuln/SNYK-JS-PRIVATEIP-9510757
CVE: CVE-2025-8021
Published: 2025-07-23
Description: All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside of the intended directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/lirantal/1f833a7d445e8cfbdcb3e75022954b35%23path-traversal-vulnerability-in-files-bucket-server; https://security.snyk.io/vuln/SNYK-JS-FILESBUCKETSERVER-9510944
CVE: CVE-2025-8022
Published: 2025-07-23
Description: Rejected reason: Bun Shell does not invoke /bin/sh, or any other interpreter, for template literals created with the $ function. Each ${…} interpolation is treated as a single argument. The security responsibility for this usage pattern lies with the calling application, which must ensure the sanitization and validation of any untrusted arguments before passing them to the executed commands. Therefore, the potential for command injection is not a flaw within Bun itself; rather, it is an argument injection that is contingent on its implementation by the consuming application.
CVE: CVE-2025-54438
Published: 2025-07-23
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54439
Published: 2025-07-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54440
Published: 2025-07-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54441
Published: 2025-07-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54442
Published: 2025-07-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54443
Published: 2025-07-23
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54444
Published: 2025-07-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://security.samsungtv.com/securityUpdates
CVE: CVE-2025-54445
Published: 2025-07-23
Description: Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Server Side Request Forgery.This issue affects MagicINFO 9 Server: less than 21.1080.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://security.samsungtv.com/securityUpdates