deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12689
Published: 2025-12-17
Description: Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2025-13217
Published: 2025-12-17
Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the YouTube Video 'value' field in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping on user-supplied YouTube video URLs in the `um_profile_field_filter_hook__youtube_video()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the injected user's profile page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/um-filters-fields.php#L80; https://plugins.trac.wordpress.org/changeset/3421362/; https://www.wordfence.com/threat-intel/vulnerabilities/id/876b57e0-cf1e-4ce9-ba85-a5d4554797bd?source=cve
CVE: CVE-2025-13321
Published: 2025-12-17
Description: Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the application logs.
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://mattermost.com/security-updates
CVE: CVE-2025-13324
Published: 2025-12-17
Description: Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
CVSS Score: 3.7 (LOW)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-13326
Published: 2025-12-17
Description: Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.
CVSS Score: 3.9 (LOW)
CWE: CWE-693
References: https://mattermost.com/security-updates
CVE: CVE-2025-13537
Published: 2025-12-17
Description: The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to multiple Stored Cross-Site Scripting vulnerabilities via DOM manipulation in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/live-composer-page-builder/trunk/js/src/client/frontend/index.js#L126; https://plugins.trac.wordpress.org/browser/live-composer-page-builder/trunk/js/src/client/frontend/index.js#L926; https://plugins.trac.wordpress.org/changeset/3419715/
CVE: CVE-2025-14081
Published: 2025-12-17
Description: The Ultimate Member plugin for WordPress is vulnerable to Profile Privacy Setting Bypass in all versions up to, and including, 2.11.0. This is due to a flaw in the secure fields mechanism where field keys are stored in the allowed fields list before the `required_perm` check is applied during rendering. This makes it possible for authenticated attackers with Subscriber-level access to modify their profile privacy settings (e.g., setting profile to "Only me") via direct parameter manipulation, even when the administrator has explicitly disabled the option for their role.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-account.php#L610; https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/um-actions-account.php#L322; https://plugins.trac.wordpress.org/changeset/3421362/
CVE: CVE-2025-14828
Published: 2025-12-17
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-62521
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-m8jq-j3p9-2xf3
CVE: CVE-2025-66395
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the `src/ListEvents.php` file. When filtering events by type, the `WhichType` POST parameter is not properly sanitized or type-casted before being used in multiple SQL queries. This allows any authenticated user to execute arbitrary SQL commands, including time-based blind SQL injection attacks. Any authenticated user, regardless of their privilege level, can execute arbitrary queries on the database. This could allow them to exfiltrate, modify, or delete any data in the database, including user credentials, financial data, and personal information, leading to a full compromise of the application's data. Version 6.5.3 fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-c9xf-f3gr-xfwv; https://github.com/ChurchCRM/CRM/security/advisories/GHSA-c9xf-f3gr-xfwv
CVE: CVE-2025-66953
Published: 2025-12-17
Description: CSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker to execute arbitrary code via the Web-based management interface and specifically the /system_setup.htm, /set_clock.htm, /receiver_setup.htm, /cal.htm?..., and /channel_setup.htm endpoints
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-66953%20_%20narda%20miteq%20Uplink%20Power%20Contril%20Unitl%20UPC2%20_%20CSRF; https://www.nardamiteq.com/; https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-66953%20_%20narda%20miteq%20Uplink%20Power%20Contril%20Unitl%20UPC2%20_%20CSRF
CVE: CVE-2025-67168
Published: 2025-12-17
Description: RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-916
References: https://github.com/handylulu/RiteCMS; https://github.com/handylulu/RiteCMS/blob/master/cms/includes/functions.admin.inc.php; https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67168
CVE: CVE-2025-67170
Published: 2025-12-17
Description: A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://github.com/handylulu/RiteCMS/; https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67170; https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67170
CVE: CVE-2025-67171
Published: 2025-12-17
Description: Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/handylulu/RiteCMS/; https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67171
CVE: CVE-2025-67173
Published: 2025-12-17
Description: A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/handylulu/RiteCMS/; https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67173; https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67173
CVE: CVE-2025-67174
Published: 2025-12-17
Description: A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal in the admin_language_file and default_page_language_file in the admin.php component
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/handylulu/RiteCMS; https://github.com/handylulu/RiteCMS/blob/master/admin.php#L46; https://github.com/handylulu/RiteCMS/blob/master/cms/subtemplates/settings.inc.tpl#L64
CVE: CVE-2025-14759
Published: 2025-12-17
Description: Missing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.

To mitigate this issue, upgrade Amazon S3 Encryption Client for .NET to version 3.2.0 or later.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-032/; https://github.com/aws/amazon-s3-encryption-client-dotnet/releases/tag/release_2025-12-17; https://github.com/aws/amazon-s3-encryption-client-dotnet/security/advisories/GHSA-4v42-65r3-3gjx
CVE: CVE-2025-14760
Published: 2025-12-17
Description: Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.

To mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-032/; https://github.com/aws/aws-sdk-cpp/releases/tag/1.11.712; https://github.com/aws/aws-sdk-cpp/security/advisories/GHSA-792f-r46x-r7gm
CVE: CVE-2025-34434
Published: 2025-12-17
Description: AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/; https://github.com/WWBN/AVideo/commit/4a53ab2056; https://github.com/WWBN/AVideo/commit/c279999cbd
CVE: CVE-2025-34435
Published: 2025-12-17
Description: AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/; https://github.com/WWBN/AVideo/commit/275a54268b; https://github.com/WWBN/AVideo/commit/4a53ab2056
CVE: CVE-2025-34436
Published: 2025-12-17
Description: AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/; https://github.com/WWBN/AVideo/commit/4a53ab2056; https://github.com/WWBN/AVideo/commit/c279999cbd
CVE: CVE-2025-34437
Published: 2025-12-17
Description: AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/; https://github.com/WWBN/AVideo/commit/4a53ab2056; https://github.com/WWBN/AVideo/commit/d411f91805
CVE: CVE-2025-34438
Published: 2025-12-17
Description: AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/; https://github.com/WWBN/AVideo/commit/4a53ab2056; https://github.com/WWBN/AVideo/commit/c2feaf25cb
CVE: CVE-2025-34439
Published: 2025-12-17
Description: AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login. An attacker can craft a link to redirect users to arbitrary external sites, enabling phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/; https://github.com/WWBN/AVideo/commit/4a53ab2056; https://github.com/WWBN/AVideo/commit/88bc40427b
CVE: CVE-2025-34440
Published: 2025-12-17
Description: AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/; https://github.com/WWBN/AVideo/commit/4a53ab2056; https://github.com/WWBN/AVideo/commit/77c70019b0
CVE: CVE-2025-34441
Published: 2025-12-17
Description: AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/; https://github.com/WWBN/AVideo/commit/1416c517e2; https://github.com/WWBN/AVideo/commit/4a53ab2056
CVE: CVE-2025-34442
Published: 2025-12-17
Description: AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/; https://github.com/WWBN/AVideo/commit/4a53ab2056; https://github.com/WWBN/AVideo/commit/dbe3e91c54
CVE: CVE-2025-65233
Published: 2025-12-17
Description: Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/hbtw25/vulnerability-research/tree/main/CVE-2025-65233; https://github.com/slims/slims9_bulian/issues/185
CVE: CVE-2025-66396
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the `src/UserEditor.php` file. When an administrator saves a user's configuration settings, the keys of the `type` POST parameter array are not properly sanitized or type-casted before being used in multiple SQL queries. This allows a malicious or compromised administrator account to execute arbitrary SQL commands, including time-based blind SQL injection attacks, to directly interact with the database. The vulnerability is located in `src/UserEditor.php` within the logic that handles saving user-specific configuration settings. The `type` parameter from the POST request is processed as an array. The code iterates through this array and uses `key($type)` to extract the array key, which is expected to be a numeric ID. This key is then assigned to the `$id` variable. The `$id` variable is subsequently concatenated directly into a `SELECT` and an `UPDATE` SQL query without any sanitization or validation, making it an injection vector. Although the vulnerability requires administrator privileges to exploit, it allows a malicious or compromised admin account to execute arbitrary SQL queries. This can be used to bypass any application-level logging or restrictions, directly manipulate the database, exfiltrate, modify, or delete all data (including other user credentials, financial records, and personal information), and could potentially lead to further system compromise, such as writing files to the server, depending on the database's configuration and user privileges. Version 6.5.3 patches the issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-whpp-wx64-4qp9
CVE: CVE-2025-66397
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. Prior to version 6.5.3, the allowRegistration, acceptKiosk, reloadKiosk, and identifyKiosk functions in the Kiosk Manager feature suffers from broken access control, allowing any authenticated user to allow and accept kiosk registrations, and perform other Kiosk Manager actions such as reload and identify. Version 6.5.3 fixes the issue.
CVSS Score: 8.3 (HIGH)
CWE: CWE-284
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-32vr-ch3p-wmr5
CVE: CVE-2025-66646
Published: 2025-12-17
Description: RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When receiving an fragmented IPv6 packet with fragment offset 0 and an empty payload, the payload pointer is set to NULL. However, the implementation still tries to copy the payload into the reassembly buffer, resulting in a NULL pointer dereference which crashes the OS (DoS). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be enabled and the attacker must be able to send arbitrary IPv6 packets to the victim. RIOT OS v2025.10 fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L411; https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L420; https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L490
CVE: CVE-2025-67073
Published: 2025-12-17
Description: A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`) to /goform/AdvSetMacMtuWan.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/johnathanhuutri/CVEReport/tree/master/CVE-2025-67073
CVE: CVE-2025-67074
Published: 2025-12-17
Description: A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serverName`) to /goform/AdvSetMacMtuWan.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/johnathanhuutri/CVEReport/tree/master/CVE-2025-67074; https://github.com/johnathanhuutri/CVEReport/tree/master/CVE-2025-67074
CVE: CVE-2025-67781
Published: 2025-12-17
Description: An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged processes to gain more privileges on Windows computers.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269
References: https://drivelock.help/en-us/Content/Home.htm
CVE: CVE-2025-67787
Published: 2025-12-17
Description: An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a network.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-002-CrossSiteScripting.htm
CVE: CVE-2025-14761
Published: 2025-12-17
Description: Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.

To mitigate this issue, upgrade AWS SDK for PHP to version 3.368.0 or later
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-032/; https://github.com/aws/aws-sdk-php/releases/tag/3.368.0; https://github.com/aws/aws-sdk-php/security/advisories/GHSA-x8cp-jf6f-r4xh
CVE: CVE-2025-14762
Published: 2025-12-17
Description: Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.


To mitigate this issue, upgrade AWS SDK for Ruby to version 1.208.0 or later.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-032/; https://github.com/aws/aws-sdk-ruby/security/advisories/GHSA-2xgq-q749-89fq; https://rubygems.org/gems/aws-sdk-s3/versions/1.208.0
CVE: CVE-2025-14763
Published: 2025-12-17
Description: Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.


To mitigate this issue, upgrade Amazon S3 Encryption Client for Java to version 4.0.0 or later.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-032/; https://github.com/aws/amazon-s3-encryption-client-java/releases/tag/v4.0.0; https://github.com/aws/amazon-s3-encryption-client-java/security/advisories/GHSA-x44p-gvrj-pj2r