deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11031
Published: 2025-09-26
Description: A flaw has been found in DataTables up to 1.10.13. The affected element is an unknown function of the file /examples/resources/examples.php. This manipulation of the argument src causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 1.10.15 is sufficient to fix this issue. Patch name: 3b24f99ac4ddb7f9072076b0d07f0b1a408f177a. Upgrading the affected component is advised. This vulnerability was initially reported for code-projects Faculty Management System but appears to affect DataTables as an upstream component instead. The vendor of DataTables explains: "I would suggest that the author upgrade to the latest versions of DataTables (actually, they shouldn't really be deploying that file to their own server at all - it is only relevant for the DataTables examples)."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/DataTables/DataTables/commit/3b24f99ac4ddb7f9072076b0d07f0b1a408f177a; https://github.com/DataTables/DataTables/releases/tag/1.10.15; https://github.com/xiaoliyu-1/Faculty-Management-System-examples.php-v.1.0-Path-Traversal/blob/main/report.md
CVE: CVE-2025-26258
Published: 2025-09-26
Description: Sourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.'
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/oye-ujjwal/CVEs/blob/main/Employee%20Management%20System%20App/CVE-2025-26258; https://www.sourcecodester.com/php/17847/employee-management-system-using-php-and-mysql-source-code.html
CVE: CVE-2025-55848
Published: 2025-09-26
Description: An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the set_cassword settings interface, as the http_casswd parameter is not filtered by '&'to allow injection of reverse connection commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/meigui637/iot_zone/blob/main/%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-59844
Published: 2025-09-26
Description: SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later.
CWE: CWE-78
References: https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281; https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0; https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f
CVE: CVE-2025-11032
Published: 2025-09-26
Description: A flaw has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This issue affects some unknown processing of the file /Profilers/PriProfile/COUNT3s6.php. Executing manipulation of the argument CPU can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/limingserverll-wq/cve/issues/3; https://vuldb.com/?ctiid.325979; https://vuldb.com/?id.325979
CVE: CVE-2025-11033
Published: 2025-09-26
Description: A vulnerability has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Impacted is an unknown function of the file /Profilers/PriProfile/COUNT3s7.php. The manipulation of the argument cbe leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/limingserverll-wq/cve/issues/4; https://vuldb.com/?ctiid.325980; https://vuldb.com/?id.325980
CVE: CVE-2025-11034
Published: 2025-09-26
Description: A vulnerability was found in Dibo Data Decision Making System up to 2.7.0. The affected element is the function downloadImpTemplet of the file /common/dep/common_dep.action.jsp. The manipulation of the argument filePath results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/FightingLzn9/vul/blob/main/%E8%BF%AA%E5%8D%9A%E6%95%B0%E6%8D%AE%E5%86%B3%E7%AD%96%E7%B3%BB%E7%BB%9F.md; https://vuldb.com/?ctiid.325981; https://vuldb.com/?id.325981
CVE: CVE-2025-45994
Published: 2025-09-26
Description: An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://arandasoft.com/en/productos/password-recovery/; https://github.com/spoNge369/CVE/blob/main/CVE-2025-45994/README.md
CVE: CVE-2025-55847
Published: 2025-09-26
Description: Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service (DoS) on the system
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/meigui637/iot_zone/blob/main/%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E.md
CVE: CVE-2025-56383
Published: 2025-09-26
Description: Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parties because the behavior only occurs when a user installs the product into a directory tree that allows write access by arbitrary unprivileged users.
CVSS Score: 8.4 (HIGH)
CWE: CWE-427
References: https://github.com/notepad-plus-plus/notepad-plus-plus; https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept; https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept/issues/1
CVE: CVE-2025-58384
Published: 2025-09-26
Description: In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc administration interface.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502
References: https://doc.doxense.com/Watchdoc/J_Securite/cve-2025-58384.htm; https://update.doxense.com/
CVE: CVE-2025-11035
Published: 2025-09-26
Description: A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-610, CWE-611, CWE-611
References: https://github.com/frwfxc123/CVE/issues/1; https://vuldb.com/?ctiid.325982; https://vuldb.com/?id.325982
CVE: CVE-2025-11036
Published: 2025-09-26
Description: A vulnerability was identified in code-projects E-Commerce Website 1.0. This affects an unknown function of the file /pages/admin_account_update.php. Such manipulation of the argument user_id leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/aCas1o/cve_report03/blob/main/report.md; https://vuldb.com/?ctiid.325983
CVE: CVE-2025-11037
Published: 2025-09-26
Description: A security flaw has been discovered in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/admin_index_search.php. Performing manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/aCas1o/cve_report04/blob/main/report.md; https://vuldb.com/?ctiid.325984
CVE: CVE-2025-11038
Published: 2025-09-26
Description: A weakness has been identified in itsourcecode Online Clinic Management System 1.0. Affected is an unknown function of the file /details.php?action=post. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://itsourcecode.com/; https://vuldb.com/?ctiid.325985; https://vuldb.com/?id.325985
CVE: CVE-2025-11039
Published: 2025-09-26
Description: A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/us_edit1.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/DavCloudz/cve/issues/1; https://vuldb.com/?ctiid.325986; https://vuldb.com/?id.325986
CVE: CVE-2025-11040
Published: 2025-09-26
Description: A vulnerability was detected in code-projects Hostel Management System 1.0. Affected by this issue is some unknown functionality of the file /justines/admin/mod_users/index.php?view=view. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/iflame28/CVE/issues/3; https://vuldb.com/?ctiid.325987
CVE: CVE-2025-11041
Published: 2025-09-26
Description: A vulnerability has been found in itsourcecode Open Source Job Portal 1.0. Affected by this issue is some unknown functionality of the file /admin/user/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/iflame28/CVE/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.325998
CVE: CVE-2025-50879
Published: 2025-09-26
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2025-57692
Published: 2025-09-26
Description: PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/PiranhaCMS/piranha.core/releases/tag/v12.0; https://github.com/Saconyfx/security-advisories/blob/main/CVE-2025-57692/advisory.md
CVE: CVE-2025-10657
Published: 2025-09-26
Description: In a hardened Docker environment, with Enhanced Container Isolation ( ECI https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation/ ) enabled, an administrator can utilize the command restrictions  feature https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation/config/#command-restrictions  to restrict commands that a container with a Docker socket mount may issue on that socket.
Due to a software bug, the configuration to restrict commands was ignored when passed to ECI, allowing any command to be executed on the socket. This grants excessive privileges by permitting unrestricted access to powerful Docker commands.

The vulnerability affects only Docker Desktop 4.46.0 users that have ECI enabled and are using the Docker socket command restrictions feature. In addition, since ECI restricts mounting the Docker socket into containers by default, it only affects containers which are explicitly allowed by the administrator to mount the Docker socket.
CWE: CWE-269
References: https://docs.docker.com/desktop/release-notes
CVE: CVE-2025-11045
Published: 2025-09-26
Description: A vulnerability was identified in WAYOS LQ_04, LQ_05, LQ_06, LQ_07 and LQ_09 22.03.17. This affects an unknown function of the file /usb_paswd.asp. The manipulation of the argument Name leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-77
References: https://vuldb.com/?ctiid.326082; https://vuldb.com/?id.326082; https://vuldb.com/?submit.658913
CVE: CVE-2025-11046
Published: 2025-09-26
Description: A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. The manipulation of the argument baseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be exploited. It is advisable to upgrade the affected component. The vendor responds: "We have confirmed that the issue mentioned in the report does not exist in the latest releases".
CVSS Score: 7.3 (HIGH)
CWE: CWE-918
References: https://github.com/Hebing123/cve/issues/90; https://vuldb.com/?ctiid.326083; https://vuldb.com/?id.326083
CVE: CVE-2025-11047
Published: 2025-09-26
Description: A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argument aluno_id causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken_Object_Level_Authorization_allows_enumeration_of_student_records_via_.module.Api.aluno.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-11047.md; https://vuldb.com/?ctiid.326084
CVE: CVE-2025-11048
Published: 2025-09-26
Description: A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-dispensas. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20%20in%20%60.consulta-dispensas%60%20Endpoint.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-11048.md; https://vuldb.com/?ctiid.326085
CVE: CVE-2025-59845
Published: 2025-09-26
Description: Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the embedding page, causing the victim’s browser to execute arbitrary GraphQL queries or mutations against their GraphQL server while authenticated with the victim’s cookies. This issue has been patched in Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3.
CVSS Score: 8.2 (HIGH)
CWE: CWE-346, CWE-352
References: https://github.com/apollographql/embeddable-explorer/security/advisories/GHSA-w87v-7w53-wwxv
CVE: CVE-2025-59934
Published: 2025-09-26
Description: Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both the email verification token login path and the password reset server action use the same validator, which does not check the token’s signature, expiration, issuer, or audience. If an attacker learns the victim’s actual user.id, they can craft an arbitrary JWT with an alg: "none" header and use it to authenticate and reset the victim’s password. This issue has been patched in version 4.0.1.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-287, CWE-345, CWE-347
References: https://github.com/formbricks/formbricks/blob/843110b0d6c37b5c0da54291616f84c91c55c4fc/apps/web/lib/jwt.ts#L114-L117; https://github.com/formbricks/formbricks/commit/eb1349f205189d5b2d4a95ec42245ca98cf68c82; https://github.com/formbricks/formbricks/pull/6596
CVE: CVE-2025-36144
Published: 2025-09-27
Description: IBM Lakehouse (watsonx.data 2.2) stores potentially sensitive information in log files that could be read by a local user.
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://www.ibm.com/support/pages/node/7246267
CVE: CVE-2025-59932
Published: 2025-09-27
Description: Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.
CVSS Score: 8.6 (HIGH)
CWE: CWE-284
References: https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-v8rh-25rf-gfqw
CVE: CVE-2025-59936
Published: 2025-09-27
Description: get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss (issuer) claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an unexpected issuer to be reused, resulting in a bypass of issuer validation. This design flaw enables a potential attack where a malicious actor crafts a pair of JWTs, the first one ensuring that a chosen public key is fetched and stored in the shared JWKS cache, and the second one leveraging that cached key to pass signature validation for a targeted iss value. The vulnerability will work only if the iss validation is done after the use of get-jwks for keys retrieval. This issue has been patched in version 11.0.2.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-116
References: https://github.com/nearform/get-jwks/commit/1706a177a80a1759fe68e3339dc5a219ce03ddb9; https://github.com/nearform/get-jwks/security/advisories/GHSA-qc2q-qhf3-235m
CVE: CVE-2025-59938
Published: 2025-09-27
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions starting from 3.8.0 to before 4.11.0, wazuh-analysisd is vulnerable to a heap buffer overflow when parsing XML elements from Windows EventChannel messages. This issue has been patched in version 4.11.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122
References: https://github.com/wazuh/wazuh/security/advisories/GHSA-vw3r-mjg3-9hh2
CVE: CVE-2025-59939
Published: 2025-09-27
Description: WeGIA is a Web manager for charitable institutions. Prior to version 3.5.0, WeGIA is vulnerable to SQL Injection attacks in the control.php endpoint with the following parameters: nomeClasse=ProdutoControle&metodo=excluir&id_produto=[malicious command]. It is necessary to apply prepared statements methods, sanitization, and validations on theid_produto parameter. This issue has been patched in version 3.5.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jx9m-pgf8-v489
CVE: CVE-2025-59945
Published: 2025-09-27
Description: SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83.
CVSS Score: 8.1 (HIGH)
CWE: CWE-266
References: https://github.com/Syslifters/sysreptor/commit/de8b5d89d0644479ee0da0a113c6bcc2436ba7f4; https://github.com/Syslifters/sysreptor/security/advisories/GHSA-r6hm-59cq-gjg6
CVE: CVE-2024-43192
Published: 2025-09-27
Description: IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.ibm.com/support/pages/node/7246245
CVE: CVE-2025-36239
Published: 2025-09-27
Description: IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 

is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7246246
CVE: CVE-2025-8440
Published: 2025-09-27
Description: The Team Members plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first and last name fields in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/team-members/trunk/inc/tmm-save-metaboxes.php#L77; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3364663%40team-members%2Ftrunk&old=3116517%40team-members%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b46c3f25-6879-47b1-9026-4297fdd003b0?source=cve
CVE: CVE-2025-10498
Published: 2025-09-27
Description: The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unauthenticated attackers to delete those files granted they can trick an administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Admin/Menus/Submissions.php#L464; https://plugins.trac.wordpress.org/changeset/3365881/ninja-forms/trunk?contextall=1&old=3362375&old_path=%2Fninja-forms%2Ftrunk#file6; https://www.wordfence.com/threat-intel/vulnerabilities/id/b082176c-9486-416c-8215-cdba4d6e5260?source=cve
CVE: CVE-2025-10499
Published: 2025-09-27
Description: The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possible for unauthenticated attackers to opt an affected site into usage statistics collection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/lib/NF_Tracking.php; https://plugins.trac.wordpress.org/changeset/3365881/ninja-forms/trunk?contextall=1&old=3362375&old_path=%2Fninja-forms%2Ftrunk#file6; https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f118fc-d99a-4713-865e-2da7a9e20db5?source=cve