deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-46059
Published: 2025-07-29
Description: langchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component. This vulnerability allows attackers to execute arbitrary code and compromise the application via a crafted email message. NOTE: this is disputed by the Supplier because the code-execution issue was introduced by user-written code that does not adhere to the LangChain security practices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Jr61-star/CVEs/blob/main/CVE-2025-46059.md; https://github.com/langchain-ai/langchain-community/issues/217#issuecomment[PII_REDACTED]; https://github.com/langchain-ai/langchain/issues/30833
CVE: CVE-2025-50738
Published: 2025-07-29
Description: The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be exploited by an attacker to disclose the viewing user's IP address, browser User-Agent string, and potentially other request-specific information to the attacker-controlled server, leading to information disclosure and user tracking.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://github.com/fai1424/Vulnerability-Research/tree/main/CVE-2025-50738; https://github.com/usememos/memos; https://github.com/usememos/memos/issues/4707#issuecomment[PII_REDACTED]
CVE: CVE-2025-51970
Published: 2025-07-29
Description: A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89
References: https://gist.github.com/im4x/10738ee219d[PII_REDACTED]7fb14cdba9f; https://github.com/jairajparyani/CVE-s/blob/main/CVE-2025-51970%20%E2%80%93%20SQL%20Injection%20Vulnerability%20in%20Online%20Shopping%20System%20Advanced
CVE: CVE-2025-28171
Published: 2025-07-29
Description: An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922
References: http://grandstream.com; http://ucm65xx.com; https://gist.github.com/Exek1el/a1fe4288f0df0a47068d618579c6b647
CVE: CVE-2025-28170
Published: 2025-07-29
Description: Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.
CVSS Score: 7.6 (HIGH)
CWE: CWE-548
References: http://grandstream.com; https://gist.github.com/Exek1el/928ea6fd06d3b48c1c91cfdc30317d8d
CVE: CVE-2025-31965
Published: 2025-07-29
Description: Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
CVSS Score: 8.2 (HIGH)
CWE: CWE-305
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122906
CVE: CVE-2025-44136
Published: 2025-07-29
Description: MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://github.com/maptiler/tileserver-php/issues/167; https://github.com/mheranco/CVE-2025-44136
CVE: CVE-2025-44137
Published: 2025-07-29
Description: MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET parameters are "TileMatrix", "TileRow", "TileCol" and "Format"
CVSS Score: 8.2 (HIGH)
CWE: CWE-22
References: https://github.com/maptiler/tileserver-php/commit/4fe14e6164bbe2a3f9e3b3d7acf303e3ec210c8e; https://github.com/maptiler/tileserver-php/issues/167; https://github.com/mheranco/CVE-2025-44137
CVE: CVE-2025-54420
Published: 2025-07-29
Description: Rejected reason: This CVE is a duplicate of CVE-2025-8129.
CVE: CVE-2025-54432
Published: 2025-07-29
Description: Rejected reason: This CVE is a duplicate of another CVE. See CVE-2018-25031 and CVE-2021-46708.
CVE: CVE-2025-5922
Published: 2025-07-29
Description: Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and requires a PIN code. In versions below v18.40.6.17 the PIN's hash is stored in a system registry accessible to regular users, making it possible to perform a brute-force attack using rainbow tables, since the hash is not salted.
LTS (Long-Term Support) versions also received patches in v17.2025.6.27 and v16.2025.6.27 releases.
CWE: CWE-522, CWE-759
References: https://cert.pl/en/posts/2025/07/CVE-2025-5922
CVE: CVE-2025-27514
Published: 2025-07-29
Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://github.com/glpi-project/glpi/commit/c340a64a11343bde706d1cd41e4be798dd922303; https://github.com/glpi-project/glpi/security/advisories/GHSA-jh8j-gqxc-6gqj
CVE: CVE-2025-2179
Published: 2025-07-29
Description: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so.

The GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
CWE: CWE-266
References: https://security.paloaltonetworks.com/CVE-2025-2179
CVE: CVE-2025-2533
Published: 2025-07-29
Description: IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789
References: https://www.ibm.com/support/pages/node/7240947
CVE: CVE-2025-2928
Published: 2025-07-29
Description: SQL Injection affecting the Archiver role.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://techdocs.genetec.com/r/en-US/Security-Updates-for-Security-Center-5.11/Resolved-vulnerabilities-in-Security-Center-5.11.3.19; https://techdocs.genetec.com/r/en-US/Security-Updates-for-Security-Center-5.12/Resolved-vulnerabilities-in-Security-Center-5.12.2.6; https://techdocs.genetec.com/r/en-US/Security-Updates-for-Security-Center-5.13/Resolved-vulnerabilities-in-Security-Center-5.13.1.1
CVE: CVE-2025-36010
Published: 2025-07-29
Description: IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 

could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-833
References: https://www.ibm.com/support/pages/node/7240951
CVE: CVE-2025-52284
Published: 2025-07-29
Description: Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/w0rkd4tt/Totolink; https://www.notion.so/setNtpCfg-20e8aff2dc8b80a3afafef36b48f7496
CVE: CVE-2025-53711
Published: 2025-07-29
Description: A vulnerability has been found in TP-Link TL-WR841N v11, TL-WR842ND v2 and TL-WR494N v3. The vulnerability exists in the /userRpm/WlanNetworkRpm.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-120
References: https://www.tp-link.com/us/support/faq/4569/
CVE: CVE-2025-53712
Published: 2025-07-29
Description: A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_AP.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-120
References: https://www.tp-link.com/us/support/faq/4569/
CVE: CVE-2025-53713
Published: 2025-07-29
Description: A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_APC.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition.  The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-120
References: https://www.tp-link.com/us/support/faq/4569/
CVE: CVE-2025-53714
Published: 2025-07-29
Description: A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WzdWlanSiteSurveyRpm_AP.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition.  The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.tp-link.com/us/support/faq/4569/
CVE: CVE-2025-53715
Published: 2025-07-29
Description: A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/Wan6to4TunnelCfgRpm.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition.  The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.tp-link.com/us/support/faq/4569/
CVE: CVE-2025-5038
Published: 2025-07-29
Description: A maliciously crafted X_T file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE: CVE-2025-5043
Published: 2025-07-29
Description: A maliciously crafted 3DM file, when linked or imported into certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE: CVE-2025-6631
Published: 2025-07-29
Description: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE: CVE-2025-6635
Published: 2025-07-29
Description: A maliciously crafted PRT file, when linked or imported into certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE: CVE-2025-6636
Published: 2025-07-29
Description: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE: CVE-2025-6637
Published: 2025-07-29
Description: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE: CVE-2025-7497
Published: 2025-07-29
Description: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE: CVE-2025-7675
Published: 2025-07-29
Description: A maliciously crafted 3DM file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE: CVE-2024-42651
Published: 2025-07-29
Description: NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SUBSCRIBE message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/nanomq/nanomq; https://github.com/nanomq/nanomq/issues/1217; https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42651.md
CVE: CVE-2024-42655
Published: 2025-07-29
Description: An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard characters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/nanomq/nanomq; https://github.com/nanomq/nanomq/issues/1782#issuecomment[PII_REDACTED]; https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42655.md
CVE: CVE-2024-49828
Published: 2025-07-29
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://www.ibm.com/support/pages/node/7240945
CVE: CVE-2024-51473
Published: 2025-07-29
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 

is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://www.ibm.com/support/pages/node/7240944
CVE: CVE-2024-52894
Published: 2025-07-29
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-121
References: https://www.ibm.com/support/pages/node/7240953
CVE: CVE-2025-33092
Published: 2025-07-29
Description: IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 

is vulnerable to a stack-based buffer overflow in db2fm, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.ibm.com/support/pages/node/7240940
CVE: CVE-2025-33114
Published: 2025-07-29
Description: IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 



is vulnerable to denial of service with a specially crafted query under certain non-default conditions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-943
References: https://www.ibm.com/support/pages/node/7240943
CVE: CVE-2025-36071
Published: 2025-07-29
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query due to improper release of memory resources.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://www.ibm.com/support/pages/node/7240955
CVE: CVE-2025-51044
Published: 2025-07-29
Description: phpgurukul Nipah virus (NiV) Testing Management System 1.0 contains a SQL injection vulnerability in the /new-user-testing.php file, due to insufficient validation of user input for the " govtissuedid" parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/bluechips-zhao/myCVE/issues/1
CVE: CVE-2025-51045
Published: 2025-07-29
Description: Phpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin/password-recovery.php file. This vulnerability is attributed to the insufficient validation of user input for the username parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/bluechips-zhao/myCVE/issues/4
CVE: CVE-2024-43018
Published: 2025-07-29
Description: Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/issues/2197; https://github.com/inesmarcal/CVE-2024-43018; https://github.com/joaosilva21/CVE-2024-43018
CVE: CVE-2025-45346
Published: 2025-07-29
Description: SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/bacula-web/bacula-web/commit/ad5d94809f17994a61496ecfec9cd3a16ac14a5f; https://github.com/bacula-web/bacula-web/releases/tag/v9.7.1
CVE: CVE-2025-52490
Published: 2025-07-29
Description: An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.
CVSS Score: 7.3 (HIGH)
CWE: CWE-319
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2025-52899
Published: 2025-07-29
Description: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99[PII_REDACTED] and Tuleap Enterprise Edition prior to 16.8-4 and 16.9-2, the forgot password form allows for user enumeration. This is fixed in Tuleap Community Edition version 16.9.99[PII_REDACTED] and Tuleap Enterprise Edition 16.8-4 and 16.9-2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://github.com/Enalean/tuleap/commit/5c72d6d253016d38ed472eb7918f772d074ddb07; https://github.com/Enalean/tuleap/security/advisories/GHSA-xqf3-xxxf-x3c2; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5c72d6d253016d38ed472eb7918f772d074ddb07
CVE: CVE-2025-53102
Published: 2025-07-29
Description: Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the `stable` branch and version 3.5.0.beta.8 on the `tests-passed` branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared from the user’s session after authentication, potentially allowing reuse and increasing security risk. This is fixed in versions 3.4.7 and 3.5.0.beta.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: https://github.com/discourse/discourse/commit/20bf65099bb861a141bc10e8a4eab65329d91802; https://github.com/discourse/discourse/commit/8bc0cee2c00a514ea60f33ea6172da2ce5a05beb; https://github.com/discourse/discourse/security/advisories/GHSA-hv49-93h5-4wcv
CVE: CVE-2025-53541
Published: 2025-07-29
Description: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99[PII_REDACTED] and Tuleap Enterprise Edition prior to 16.8-5 and 16.9-3, malicious users with some control over certain artifacts could insert malicious code when displaying the children of a parent artifact to force victims to execute the uncontrolled code. This is fixed in version Tuleap Community Edition prior to version 16.9.99[PII_REDACTED] and Tuleap Enterprise Edition prior to 16.8-5 and 16.9-3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://github.com/Enalean/tuleap/commit/c1aec8247697d63dc4af791ecd6bd70d105ded08; https://github.com/Enalean/tuleap/security/advisories/GHSA-6r66-j76j-rwhw; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=c1aec8247697d63dc4af791ecd6bd70d105ded08
CVE: CVE-2025-53902
Published: 2025-07-29
Description: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99[PII_REDACTED] and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5, users may potentially access confidential information from artifacts that they are not authorized to view. This is fixed in Tuleap Community Edition prior to version 16.9.99[PII_REDACTED] and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/Enalean/tuleap/commit/ebe054df8a2672afee41af84e5ba14b57ef8b789; https://github.com/Enalean/tuleap/security/advisories/GHSA-6f24-5v47-rj6j; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ebe054df8a2672afee41af84e5ba14b57ef8b789