deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-27636
Published: 2025-03-09
Description: Bypass/Injection vulnerability in Apache Camel components under particular conditions.

This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3.

Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.



This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific

headers that for some Camel components can alter the behaviours such as the camel-bean component, to call another method

on the bean, than was coded in the application. In the camel-jms component, then a malicious header can be used to send

the message to another queue (on the same broker) than was coded in the application. This could also be seen by using the camel-exec component




The attacker would need to inject custom headers, such as HTTP protocols. So if you have Camel applications that are

directly connected to the internet via HTTP, then an attacker could include malicious HTTP headers in the HTTP requests

that are send to the Camel application.




All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box.

In these conditions an attacker could be able to forge a Camel header name and make the bean component invoking other methods in the same bean.

In terms of usage of the default header filter strategy the list of components using that is: 


  *  camel-activemq
  *  camel-activemq6
  *  camel-amqp
  *  camel-aws2-sqs
  *  camel-azure-servicebus
  *  camel-cxf-rest
  *  camel-cxf-soap
  *  camel-http
  *  camel-jetty
  *  camel-jms
  *  camel-kafka
  *  camel-knative
  *  camel-mail
  *  camel-nats
  *  camel-netty-http
  *  camel-platform-http
  *  camel-rest
  *  camel-sjms
  *  camel-spring-rabbitmq
  *  camel-stomp
  *  camel-tahu
  *  camel-undertow
  *  camel-xmpp






The vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting with "Camel", "camel", or "org.apache.camel.". 


Mitigation: You can easily work around this in your Camel applications by removing the headers in your Camel routes. There are many ways of doing this, also globally or per route. This means you could use the removeHeaders EIP, to filter out anything like "cAmel, cAMEL" etc, or in general everything not starting with "Camel", "camel" or "org.apache.camel.".
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-178
References: https://camel.apache.org/security/CVE-2025-27636.html; https://issues.apache.org/jira/browse/CAMEL-21828; https://lists.apache.org/thread/l3zcg3vts88bmc7w8172wkgw610y693z
CVE: CVE-2025-2122
Published: 2025-03-09
Description: A vulnerability classified as problematic was found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected by this vulnerability is an unknown functionality of the component Connection Handler. The manipulation leads to denial of service. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-404, CWE-404
References: https://github.com/geo-chen/Thinkware-Dashcam; https://vuldb.com/?ctiid.299035; https://vuldb.com/?id.299035
CVE: CVE-2025-2123
Published: 2025-03-09
Description: A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function get_var of the file /contrib/cssgen.php of the component CSS Handler. The manipulation of the argument default-styles/keywords-1/keywords-2/keywords-3/keywords-4/comments leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/GeSHi/geshi-1.0/issues/159; https://github.com/GeSHi/geshi-1.0/issues/159#issue[PII_REDACTED]; https://vuldb.com/?ctiid.299036
CVE: CVE-2025-2124
Published: 2025-03-09
Description: A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.svc/change_password of the component API Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.299037; https://vuldb.com/?id.299037
CVE: CVE-2025-2125
Published: 2025-03-09
Description: A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/comprovante_marcacao/?companyId=1 of the component PDF Document Handler. The manipulation of the argument nsr leads to improper control of resource identifiers. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-99, CWE-639
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.299038; https://vuldb.com/?id.299038
CVE: CVE-2025-2126
Published: 2025-03-09
Description: A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the argument title leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.299039; https://vuldb.com/?id.299039; https://vuldb.com/?submit.509884
CVE: CVE-2025-2127
Published: 2025-03-09
Description: A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.299040; https://vuldb.com/?id.299040; https://vuldb.com/?submit.509891
CVE: CVE-2025-2129
Published: 2025-03-09
Description: A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default initialization of resource. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. After 7 months of repeated follow-ups by the researcher, Mage AI has decided to not accept this issue as a valid security vulnerability and has confirmed that they will not be addressing it.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-1188
References: https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md; https://vuldb.com/?ctiid.299049; https://vuldb.com/?id.299049
CVE: CVE-2025-26204
Published: 2025-03-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2025-26205
Published: 2025-03-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2025-2130
Published: 2025-03-09
Description: A vulnerability was found in OpenXE up to 1.12. It has been declared as problematic. This vulnerability affects unknown code of the component Ticket Bearbeiten Page. The manipulation of the argument Notizen leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/janssensjelle/published-pocs/blob/main/openxe-xss-ticket.md; https://vuldb.com/?ctiid.299050; https://vuldb.com/?id.299050
CVE: CVE-2025-2131
Published: 2025-03-09
Description: A vulnerability was found in dayrui XunRuiCMS up to 4.6.3. It has been rated as problematic. This issue affects some unknown processing of the component Friendly Links Handler. The manipulation of the argument Website Address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/dayrui/xunruicms/issues/7; https://vuldb.com/?ctiid.299051; https://vuldb.com/?id.299051
CVE: CVE-2025-2132
Published: 2025-03-09
Description: A vulnerability classified as critical has been found in ftcms 2.1. Affected is an unknown function of the file /admin/index.php/web/ajax_all_lists of the component Search. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ahieafe/zpp/issues/2; https://vuldb.com/?ctiid.299052; https://vuldb.com/?id.299052
CVE: CVE-2025-2133
Published: 2025-03-10
Description: A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/index.php/news/edit. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/ahieafe/zpp/issues/3; https://vuldb.com/?ctiid.299053; https://vuldb.com/?id.299053
CVE: CVE-2024-41724
Published: 2025-03-10
Description: Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. 




This issue affects all versions of Gallagher Command Centre prior to 9.20.1043.
CVSS Score: 8.7 (HIGH)
CWE: CWE-295
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-41724
CVE: CVE-2024-43107
Published: 2025-03-10
Description: Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin.
This issue effects Gallagher MIPS Plugin v4.0 prior to v4.0.32, all versions of v3.0 and prior.
CVSS Score: 7.2 (HIGH)
CWE: CWE-295
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43107
CVE: CVE-2025-1926
Published: 2025-03-10
Description: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayer_save_post function. This makes it possible for unauthenticated attackers to modify post contents via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/pagelayer/tags/1.9.8/init.php#L477; https://www.wordfence.com/threat-intel/vulnerabilities/id/542b6312-b264-49d5-882a-454427c60c8a?source=cve
CVE: CVE-2024-11638
Published: 2025-03-10
Description: The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/2f20336f-e12e-4b09-bcaf-45f7249f6495/
CVE: CVE-2025-2150
Published: 2025-03-10
Description: The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malicious JavaScript code, which will be executed in the recipient's browser when they view the email.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-10005-05e0f-2.html; https://www.twcert.org.tw/tw/cp-132-10004-99474-1.html
CVE: CVE-2025-27253
Published: 2025-03-10
Description: A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-15
References: https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27253
CVE: CVE-2025-27254
Published: 2025-03-10
Description: CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. 
The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.
CVSS Score: 8.0 (HIGH)
CWE: CWE-282
References: https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27254
CVE: CVE-2025-27255
Published: 2025-03-10
Description: Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcoded password retrievable by an attacker analyzing the application code.
CVSS Score: 8.0 (HIGH)
CWE: CWE-798
References: https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27255
CVE: CVE-2025-27256
Published: 2025-03-10
Description: Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH server authentication. Since the client connection is not authenticated, an attacker may perform a man-in-the-middle attack on the network.
CVSS Score: 8.3 (HIGH)
CWE: CWE-306
References: https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27256
CVE: CVE-2025-27257
Published: 2025-03-10
Description: Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware.
The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-345
References: https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27257
CVE: CVE-2024-13918
Published: 2025-03-10
Description: The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/laravel/framework/pull/53869; https://github.com/laravel/framework/releases/tag/v11.36.0; https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page
CVE: CVE-2024-13919
Published: 2025-03-10
Description: The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/laravel/framework/pull/53869; https://github.com/laravel/framework/releases/tag/v11.36.0; https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-02_Laravel_Reflected_XSS_via_Route_Parameter_in_Debug-Mode_Error_Page
CVE: CVE-2025-24387
Published: 2025-03-10
Description: A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive 
cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation.
 

This issue affects:

  *  OTRS 7.0.X
  *  OTRS 8.0.X
  *  OTRS 2023.X
  *  OTRS 2024.X
  *  OTRS 2025.x
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-1275, CWE-352
References: https://otrs.com/release-notes/otrs-security-advisory-2025-05/
CVE: CVE-2025-2147
Published: 2025-03-10
Description: A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425, CWE-552, CWE-425
References: https://github.com/fubxx/CVE/blob/main/%E7%91%9E%E7%94%B0%E7%8E%B0%E4%BB%A3%E5%86%9C%E5%9C%BA%E6%95%B0%E5%AD%97%E5%8C%96%E7%BB%BC%E5%90%88%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86.md; https://vuldb.com/?ctiid.299058; https://vuldb.com/?id.299058
CVE: CVE-2025-1944
Published: 2025-03-10
Description: picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781; https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7q5r-7gvp-wc82; https://www.sonatype.com/security-advisories/cve-2025-1944
CVE: CVE-2025-1945
Published: 2025-03-10
Description: picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781; https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792; https://www.sonatype.com/security-advisories/cve-2025-1945
CVE: CVE-2025-2148
Published: 2025-03-10
Description: A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end_callbacks_on_jit_fut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: https://github.com/pytorch/pytorch/issues/147722; https://vuldb.com/?ctiid.299059; https://vuldb.com/?id.299059
CVE: CVE-2025-2149
Published: 2025-03-10
Description: A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initialization. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.5 (LOW)
CWE: CWE-665
References: https://github.com/pytorch/pytorch/issues/147818; https://github.com/pytorch/pytorch/issues/147818#issue[PII_REDACTED]; https://vuldb.com/?ctiid.299060
CVE: CVE-2025-2151
Published: 2025-03-10
Description: A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/assimp/assimp/issues/6016; https://github.com/assimp/assimp/issues/6026; https://github.com/sae-as-me/Crashes/raw/refs/heads/main/assimp/assimp_crash_1
CVE: CVE-2024-57492
Published: 2025-03-10
Description: An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the round_up_to_page funciton.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-1262
References: https://github.com/Marsman1996/pocs/blob/master/redox/CVE-2024-57492/README.md; https://gitlab.redox-os.org/redox-os/relibc/-/issues/200; https://gitlab.redox-os.org/redox-os/relibc/-/merge_requests/569
CVE: CVE-2025-1497
Published: 2025-03-10
Description: A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code.
Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk. The vendor does not plan to release a patch to fix this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-77
References: https://cert.pl/en/posts/2025/03/CVE-2025-1497; https://cert.pl/posts/2025/03/CVE-2025-1497; https://github.com/mljar/plotai
CVE: CVE-2025-25615
Published: 2025-03-10
Description: Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://github.com/armaansidana2003/CVE-2025-25615; https://github.com/changeweb/Unifiedtransform
CVE: CVE-2025-25616
Published: 2025-03-10
Description: Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam_rule_id=1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/armaansidana2003/CVE-2025-25616; https://github.com/changeweb/Unifiedtransform