deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-25146
Published: 2025-12-24
Description: Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes. Attackers can send arbitrary signals to kill background processes and system services through a hidden feature, potentially causing service disruption and requiring device restart.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: http://www.microhardcorp.com; https://www.exploit-db.com/exploits/45035; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5481.php
CVE: CVE-2018-25147
Published: 2025-12-24
Description: Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these default credentials to gain unauthorized root-level access to the device by logging in with predefined username and password combinations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1392
References: http://www.microhardcorp.com; https://www.exploit-db.com/exploits/45040; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5480.php
CVE: CVE-2018-25148
Published: 2025-12-24
Description: Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attackers to create crontab jobs and modify system startup scripts. Attackers can exploit hidden admin features to execute arbitrary commands with root privileges, including starting services, disabling firewalls, and writing files to the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: http://www.microhardcorp.com; https://www.exploit-db.com/exploits/45038; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5479.php
CVE: CVE-2018-25149
Published: 2025-12-24
Description: Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change admin passwords, add new users, and modify system settings by tricking authenticated users into loading a specially crafted page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.microhardcorp.com; https://www.exploit-db.com/exploits/45034; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5478.php
CVE: CVE-2018-25150
Published: 2025-12-24
Description: Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a hidden form to add a superuser account by tricking a logged-in administrator into loading the page.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://www.ecessa.com; https://www.exploit-db.com/exploits/44938
CVE: CVE-2018-25151
Published: 2025-12-24
Description: Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft a malicious web page with a hidden form to create a new superuser account by tricking an authenticated administrator into loading the page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.ecessa.com; https://www.exploit-db.com/exploits/44936
CVE: CVE-2018-25152
Published: 2025-12-24
Description: Ecessa Edge EV150 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a form that submits requests to the /cgi-bin/pl_web.cgi/util_configlogin_act endpoint to add superuser accounts with arbitrary credentials.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://www.ecessa.com; https://www.exploit-db.com/exploits/44932
CVE: CVE-2018-25153
Published: 2025-12-24
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported issue does not constitute a security vulnerability and represents a minor, non-exploitable memory leak.
CVE: CVE-2018-25154
Published: 2025-12-24
Description: GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exploit boundary errors during input file processing to potentially execute arbitrary code on the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://directory.fsf.org/wiki/Barcode; https://www.exploit-db.com/exploits/44797; https://www.gnu.org/software/barcode/
CVE: CVE-2018-25155
Published: 2025-12-24
Description: Teradek Slice 7.3.15 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft a malicious web page that automatically submits password change requests to the device when a logged-in user visits the page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/44676; https://www.teradek.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5467.php
CVE: CVE-2018-25156
Published: 2025-12-24
Description: Teradek Cube 7.3.6 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft a malicious web page with a hidden form to submit password change requests to the device's system configuration interface.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/44675; https://www.teradek.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5464.php
CVE: CVE-2019-25233
Published: 2025-12-24
Description: AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://www.ave.it; https://www.domoticaplus.it; https://www.exploit-db.com/exploits/47821
CVE: CVE-2019-25234
Published: 2025-12-24
Description: SmartHouse Webapp 6.5.33 contains multiple cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform unauthorized actions. Attackers can exploit these vulnerabilities by tricking logged-in users into visiting malicious websites or injecting malicious scripts into various application parameters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-352
References: http://www.smarthouse.nu; https://www.exploit-db.com/exploits/47730; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5543.php
CVE: CVE-2019-25235
Published: 2025-12-24
Description: Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disabling JavaScript. Attackers can navigate to multiple administrative endpoints and to bypass client-side validation and access sensitive system information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://www.exploit-db.com/exploits/47595; https://www.smartwares.eu; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5540.php
CVE: CVE-2019-25236
Published: 2025-12-24
Description: iSeeQ Hybrid DVR WH-H4 1.03R contains an unauthenticated vulnerability in the get_jpeg script that allows unauthorized access to live video streams. Attackers can retrieve video snapshots from specific camera channels by sending requests to the /cgi-bin/get_jpeg endpoint without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://www.iseeq.co.kr; https://www.exploit-db.com/exploits/47562; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5539.php
CVE: CVE-2019-25237
Published: 2025-12-24
Description: V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the user role parameter. Attackers can send a crafted HTTP POST request to the user management endpoint with 'user_role_mod' set to integer value '1' to elevate their privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://www.exploit-db.com/exploits/47435; https://www.vsolcn.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5538.php
CVE: CVE-2019-25238
Published: 2025-12-24
Description: V-SOL GPON/EPON OLT Platform 2.03 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to create admin users, enable SSH, or modify system settings by tricking authenticated administrators into loading a specially crafted page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/47434; https://www.vsolcn.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5536.php
CVE: CVE-2019-25239
Published: 2025-12-24
Description: V-SOL GPON/EPON OLT Platform 2.03 contains an unauthenticated information disclosure vulnerability that allows attackers to download configuration files via direct object reference. Attackers can retrieve sensitive configuration data by sending HTTP GET requests to the usrcfg.conf endpoint, potentially enabling authentication bypass and system access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://www.exploit-db.com/exploits/47433; https://www.vsolcn.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5534.php
CVE: CVE-2019-25240
Published: 2025-12-24
Description: Rifatron 5brid DVR contains an unauthenticated vulnerability in the animate.cgi script that allows unauthorized access to live video streams. Attackers can exploit the Mobile Web Viewer module by specifying channel numbers to retrieve sequential video snapshots without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://www.rifatron.com; https://www.exploit-db.com/exploits/47368; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5532.php
CVE: CVE-2019-25241
Published: 2025-12-24
Description: FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.iwt.com.hk; https://www.exploit-db.com/exploits/47067; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php
CVE: CVE-2019-25242
Published: 2025-12-24
Description: FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by tricking authenticated users into loading a specially crafted webpage.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.iwt.com.hk; https://www.exploit-db.com/exploits/47065; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php
CVE: CVE-2019-25243
Published: 2025-12-24
Description: FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitized input parameters to inject and execute arbitrary shell commands with root privileges by manipulating the 'strInIP' and 'strInPort' parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.iwt.com.hk; https://www.exploit-db.com/exploits/47064; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5523.php
CVE: CVE-2019-25244
Published: 2025-12-24
Description: Legrand BTicino Driver Manager F454 1.0.51 contains multiple web vulnerabilities that allow attackers to perform administrative actions without proper request validation. Attackers can exploit cross-site request forgery to change passwords and inject stored cross-site scripting payloads through unvalidated GET parameters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://www.bticino.com; https://www.exploit-db.com/exploits/46850; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5521.php
CVE: CVE-2019-25245
Published: 2025-12-24
Description: Ross Video DashBoard 8.5.1 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files due to improper permission settings. Attackers can exploit the 'M' or 'C' flags for 'Authenticated Users' group to replace the DashBoard.exe binary with a malicious executable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://www.exploit-db.com/exploits/46742; https://www.rossvideo.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5516.php
CVE: CVE-2019-25246
Published: 2025-12-24
Description: Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability that allows attackers to read arbitrary system files via the 'READ.filePath' parameter. Attackers can exploit the fileread script or SendCGICMD API to access sensitive files like /etc/passwd and /etc/issue by supplying absolute file paths.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.beward.net; https://www.exploit-db.com/exploits/46320; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5511.php
CVE: CVE-2019-25247
Published: 2025-12-24
Description: Beward N100 H.264 VGA IP Camera M2.1.6 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft a malicious web page with a hidden form to add an admin user by tricking a logged-in user into submitting the form.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://www.beward.net; https://www.exploit-db.com/exploits/46318; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5510.php
CVE: CVE-2019-25248
Published: 2025-12-24
Description: Beward N100 M2.1.6.04C014 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly retrieve the camera's RTSP stream by exploiting the lack of authentication in the video access mechanism.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.beward.net; https://www.exploit-db.com/exploits/46317; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5509.php
CVE: CVE-2019-25249
Published: 2025-12-24
Description: devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI script. Attackers can enable telnet and remote shell services, reboot the device, and gain root access without a password by manipulating system configuration parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://www.devolo.com; https://www.exploit-db.com/exploits/46325; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5508.php
CVE: CVE-2019-25250
Published: 2025-12-24
Description: Devolo dLAN 500 AV Wireless+ 3.1.0-1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages that trigger unauthorized configuration changes by exploiting predictable URL actions when a logged-in user visits the site.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://www.devolo.com; https://www.exploit-db.com/exploits/46324; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5507.php
CVE: CVE-2019-25251
Published: 2025-12-24
Description: Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'url' and 'xml_url'. Attackers can exploit this flaw to bypass firewalls, initiate network enumeration, and potentially trigger external HTTP requests to arbitrary destinations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://www.exploit-db.com/exploits/44672; https://www.teradek.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5461.php
CVE: CVE-2019-25252
Published: 2025-12-24
Description: Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/44671; https://www.teradek.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php
CVE: CVE-2019-25253
Published: 2025-12-24
Description: KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers to read arbitrary system files. Attackers can craft a malicious XML file with external entity references to retrieve sensitive configuration data like database credentials through an out-of-band channel attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://global.kyocera.com; https://www.exploit-db.com/exploits/44430; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5459.php
CVE: CVE-2019-25254
Published: 2025-12-24
Description: KYOCERA Net Admin 3.4.0906 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft malicious web pages that automatically submit forms to add new admin accounts with predefined credentials when a logged-in user visits the page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://global.kyocera.com; https://www.exploit-db.com/exploits/44431; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5458.php
CVE: CVE-2019-25255
Published: 2025-12-24
Description: VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows attackers to execute system commands with root privileges. Attackers can exploit the vulnerability through a cross-site request forgery (CSRF) mechanism to gain unauthorized system access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-78
References: http://www.video-flow.com; https://www.exploit-db.com/exploits/44387; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5455.php
CVE: CVE-2019-25256
Published: 2025-12-24
Description: VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers to access arbitrary system files through unvalidated 'ID' parameters. Attackers can exploit multiple Perl scripts like downloadsys.pl to read sensitive files by manipulating directory path traversal in download requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.video-flow.com; https://www.exploit-db.com/exploits/44386; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5454.php
CVE: CVE-2019-25257
Published: 2025-12-24
Description: LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command, ocr.Tesseract.path, and other system paths to execute arbitrary system commands with elevated privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-426
References: https://www.exploit-db.com/exploits/44021; https://www.logicaldoc.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5452.php
CVE: CVE-2019-25258
Published: 2025-12-24
Description: LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/44019; https://www.logicaldoc.com; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5450.php
CVE: CVE-2025-3232
Published: 2025-12-24
Description: A remote unauthenticated attacker may be able to bypass authentication 
by utilizing a specific API route to execute arbitrary OS commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://emea.mitsubishielectric.com/fa/products/quality/quality-news-information; https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-105-09.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-09
CVE: CVE-2025-68914
Published: 2025-12-24
Description: Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/gerico-lab/riello-multiple-vulnerabilities-2025
CVE: CVE-2025-68915
Published: 2025-12-24
Description: Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted banner.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/gerico-lab/riello-multiple-vulnerabilities-2025
CVE: CVE-2025-68916
Published: 2025-12-24
Description: Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-25, CWE-22
References: https://github.com/gerico-lab/riello-multiple-vulnerabilities-2025
CVE: CVE-2025-68917
Published: 2025-12-24
Description: ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921
CVE: CVE-2025-68919
Published: 2025-12-24
Description: Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessible by a principal/authority other than ETERNUS SF Admin, allows an attacker to potentially affect system confidentiality, integrity, and availability.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-532
References: https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-STR-2025-111413-Security-Notice.pdf
CVE: CVE-2025-8769
Published: 2025-12-24
Description: Telenium Online Web Application is vulnerable due to a Perl script that 
is called to load the login page. Due to improper input validation, an 
attacker can inject arbitrary Perl code through a crafted HTTP request, 
leading to remote code execution on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-263-04.json; https://megasys.com/support/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04
CVE: CVE-2025-68920
Published: 2025-12-24
Description: C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.
CVSS Score: 8.9 (HIGH)
CWE: CWE-862
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123025; https://github.com/KermitProject/ckermit/pull/20; https://www.complete.org/kermit/
CVE: CVE-2025-15073
Published: 2025-12-24
Description: A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/24ggee/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.338330