deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-41747
Published: 2025-12-09
Description: An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41748
Published: 2025-12-09
Description: An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41749
Published: 2025-12-09
Description: An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41750
Published: 2025-12-09
Description: An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41751
Published: 2025-12-09
Description: An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41752
Published: 2025-12-09
Description: An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://certvde.com/en/advisories/VDE-2025-071/
CVE: CVE-2025-42872
Published: 2025-12-09
Description: Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result, the vulnerability has a low impact on confidentiality and integrity and no impact on availability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-489
References: https://me.sap.com/notes/3662622; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42873
Published: 2025-12-09
Description: SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system unresponsiveness due to a blocked processing thread. This vulnerability has no impact on confidentiality or integrity but has a high impact on system availability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-405
References: https://me.sap.com/notes/3676970; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42874
Published: 2025-12-09
Description: SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls. Exploitation does not require user interaction and could lead to service disruption or unauthorized system control. This has high impact on integrity and availability, with no impact on confidentiality.
CVSS Score: 7.9 (HIGH)
CWE: CWE-405
References: https://me.sap.com/notes/3640185; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42875
Published: 2025-12-09
Description: The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the application.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-306
References: https://me.sap.com/notes/3591163; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42876
Published: 2025-12-09
Description: Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials General Ledger), an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all company codes. Successful exploitation could result in a high impact to confidentiality and a low impact to integrity, while availability remains unaffected.
CVSS Score: 7.1 (HIGH)
CWE: CWE-405
References: https://me.sap.com/notes/3672151; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42877
Published: 2025-12-09
Description: SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server allow an unauthenticated user to exploit logical errors that lead to a memory corruption vulnerability. This results in high impact on the availability with no impact on confidentiality or integrity of the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://me.sap.com/notes/3677544; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42878
Published: 2025-12-09
Description: SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.
CVSS Score: 8.2 (HIGH)
CWE: CWE-1244
References: https://me.sap.com/notes/3684682; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42880
Published: 2025-12-09
Description: Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://me.sap.com/notes/3685270; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42891
Published: 2025-12-09
Description: Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of database tables into an ABAP report. This could lead to a high impact on data confidentiality and a low impact on data integrity. There is no impact on application's availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3659117; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42896
Published: 2025-12-09
Description: SAP BusinessObjects Business Intelligence Platform lets an unauthenticated remote attacker send crafted requests through the URL parameter that controls the login page error message. This can cause the server to fetch attacker-supplied URLs, resulting in low impact to confidentiality and integrity, and no impact to availability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-116
References: https://me.sap.com/notes/3651390; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42904
Published: 2025-12-09
Description: Due to an Information Disclosure vulnerability in Application Server ABAP, an authenticated attacker could read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity or availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-549
References: https://me.sap.com/notes/3662324; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42928
Published: 2025-12-09
Description: Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://me.sap.com/notes/3685286; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-49341
Published: 2025-12-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Alex Furr PDF Creator Lite pdf-creator-lite allows Stored XSS.This issue affects PDF Creator Lite: from n/a through <= 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/pdf-creator-lite/vulnerability/wordpress-pdf-creator-lite-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49347
Published: 2025-12-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jupitercow WP sIFR wp-sifr allows Stored XSS.This issue affects WP sIFR: from n/a through <= 0.6.8.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-sifr/vulnerability/wordpress-wp-sifr-plugin-0-6-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49348
Published: 2025-12-09
Description: Missing Authorization vulnerability in Hype Hype pico allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hype: from n/a through <= 1.0.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/pico/vulnerability/wordpress-hype-plugin-1-0-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49350
Published: 2025-12-09
Description: Missing Authorization vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Actionwear products sync: from n/a through <= 2.3.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/actionwear-products-sync/vulnerability/wordpress-actionwear-products-sync-plugin-2-3-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49351
Published: 2025-12-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Valentin Agachi Create Posts & Terms create-posts-terms allows Stored XSS.This issue affects Create Posts & Terms: from n/a through <= 1.3.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/create-posts-terms/vulnerability/wordpress-create-posts-terms-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-59029
Published: 2025-12-09
Description: An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-07.html
CVE: CVE-2025-59030
Published: 2025-12-09
Description: An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html
CVE: CVE-2025-59132
Published: 2025-12-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Badi Jones Duplicate Content Cure duplicate-content-cure allows Cross Site Request Forgery.This issue affects Duplicate Content Cure: from n/a through <= 1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/duplicate-content-cure/vulnerability/wordpress-duplicate-content-cure-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-5469
Published: 2025-12-09
Description: Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245
CWE: CWE-427
References: https://yandex.com/bugbounty/i/hall-of-fame-products
CVE: CVE-2025-5470
Published: 2025-12-09
Description: Uncontrolled Search Path Element vulnerability in Yandex Disk on MacOS allows Search Order Hijacking.This issue affects Disk: before 3.2.45.3275.
CWE: CWE-427
References: https://yandex.com/bugbounty/i/hall-of-fame-products
CVE: CVE-2025-5471
Published: 2025-12-09
Description: Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://yandex.com/bugbounty/i/hall-of-fame-products
CVE: CVE-2025-61074
Published: 2025-12-09
Description: A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the '/SchwarzeBrett/Nachrichten/CreateNachricht' or '/SchwarzeBrett/Nachrichten/EditNachricht/' requests.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://no-sec.net/posts/cve-2025-61074/; https://www.adata.de/mitarbeiter-portal/
CVE: CVE-2025-61075
Published: 2025-12-09
Description: Multiple Incorrect Access Control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2.0 allow remote authenticated, low-privileged users to carry out administrative functions and manipulate data of other users via unauthorized API calls.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://no-sec.net/posts/cve-2025-61075/; https://www.adata.de/mitarbeiter-portal/
CVE: CVE-2025-62082
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows Stored XSS.This issue affects Generic Elements: from n/a through <= 1.2.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/generic-elements-for-elementor/vulnerability/wordpress-generic-elements-plugin-1-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-62085
Published: 2025-12-09
Description: Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through <= 1.13.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/bertha-ai-free/vulnerability/wordpress-bertha-ai-plugin-1-13-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-62086
Published: 2025-12-09
Description: Missing Authorization vulnerability in akazanstev Яндекс Доставка (Boxberry) boxberry allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Яндекс Доставка (Boxberry): from n/a through <= 2.34.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/boxberry/vulnerability/wordpress-yandeks-dostavka-boxberry-plugin-2-32-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-62090
Published: 2025-12-09
Description: Missing Authorization vulnerability in Jegstudio Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons gutenverse-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons: from n/a through <= 3.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/gutenverse-news/vulnerability/wordpress-gutenverse-news-advanced-news-magazine-blog-gutenberg-blocks-addons-plugin-3-0-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-62093
Published: 2025-12-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Image&Video FullScreen Background lbg_fullscreen_fullwidth_slider allows SQL Injection.This issue affects Image&Video FullScreen Background: from n/a through <= 1.6.7.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/lbg_fullscreen_fullwidth_slider/vulnerability/wordpress-image-video-fullscreen-background-plugin-1-6-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-62100
Published: 2025-12-09
Description: Missing Authorization vulnerability in themerain ThemeRain Core themerain-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeRain Core: from n/a through <= 1.1.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/themerain-core/vulnerability/wordpress-themerain-core-plugin-1-1-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-62102
Published: 2025-12-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/dofollow-case-by-case/vulnerability/wordpress-dofollow-case-by-case-plugin-3-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-62103
Published: 2025-12-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in wpmediadownload Media Library File Download media-download allows Cross Site Request Forgery.This issue affects Media Library File Download: from n/a through <= 1.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/media-download/vulnerability/wordpress-media-library-file-download-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-62109
Published: 2025-12-09
Description: Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/cf-geoplugin/vulnerability/wordpress-geo-controller-plugin-8-9-4-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-62151
Published: 2025-12-09
Description: Missing Authorization vulnerability in Virtuaria Virtuaria PagBank / PagSeguro para Woocommerce virtuaria-pagseguro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virtuaria PagBank / PagSeguro para Woocommerce: from n/a through <= 3.6.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/virtuaria-pagseguro/vulnerability/wordpress-virtuaria-pagbank-pagseguro-para-woocommerce-plugin-3-6-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-62152
Published: 2025-12-09
Description: Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ConveyThis: from n/a through <= 269.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/conveythis-translate/vulnerability/wordpress-conveythis-plugin-268-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-62153
Published: 2025-12-09
Description: Missing Authorization vulnerability in Graham Quick Interest Slider quick-interest-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Interest Slider: from n/a through <= 3.1.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/quick-interest-slider/vulnerability/wordpress-quick-interest-slider-plugin-3-1-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-62733
Published: 2025-12-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in ProteusThemes Custom Sidebars by ProteusThemes custom-sidebars-by-proteusthemes allows Cross Site Request Forgery.This issue affects Custom Sidebars by ProteusThemes: from n/a through <= 1.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/custom-sidebars-by-proteusthemes/vulnerability/wordpress-custom-sidebars-by-proteusthemes-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-62734
Published: 2025-12-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in M.Code Media Library Downloader media-library-downloader allows Cross Site Request Forgery.This issue affects Media Library Downloader: from n/a through <= 1.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/media-library-downloader/vulnerability/wordpress-media-library-downloader-plugin-1-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-62735
Published: 2025-12-09
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Joel User Spam Remover user-spam-remover allows Retrieve Embedded Sensitive Data.This issue affects User Spam Remover: from n/a through <= 1.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/user-spam-remover/vulnerability/wordpress-user-spam-remover-plugin-1-1-sensitive-data-exposure-vulnerability?_s_id=cve