deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-53084
Published: 2025-07-24
Description: A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2206; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2206; https://talosintelligence.com/vulnerability_reports/TALOS-2025-2206
CVE: CVE-2025-45702
Published: 2025-07-24
Description: SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-256
References: https://raw.githubusercontent.com/christiankold/Vulnerabilities/refs/heads/main/CVE-2025-45702; https://softperfect.com
CVE: CVE-2025-5039
Published: 2025-07-24
Description: A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0014
CVE: CVE-2025-8115
Published: 2025-07-24
Description: A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/new-autoortaxi-entry-form.php. The manipulation of the argument registrationnumber/licensenumber leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/LagonGit/ReportCVE/issues/11; https://phpgurukul.com/; https://vuldb.com/?ctiid.317497
CVE: CVE-2025-6998
Published: 2025-07-24
Description: ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
CWE: CWE-1333
References: https://fluidattacks.com/advisories/megadeth; https://github.com/gelbphoenix/autocaliweb; https://github.com/janeczku/calibre-web
CVE: CVE-2025-31952
Published: 2025-07-24
Description: HCL iAutomate is affected by an insufficient session expiration.  This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access.
CVSS Score: 7.1 (HIGH)
CWE: CWE-613
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122646
CVE: CVE-2025-31953
Published: 2025-07-24
Description: HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties.
CVSS Score: 7.1 (HIGH)
CWE: CWE-798
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122646
CVE: CVE-2025-31955
Published: 2025-07-24
Description: HCL iAutomate is affected by a sensitive data exposure vulnerability.  This issue may allow unauthorized access to sensitive information within the system.
CVSS Score: 7.6 (HIGH)
CWE: CWE-200
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122646
CVE: CVE-2025-6260
Published: 2025-07-24
Description: The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-02
CVE: CVE-2025-7404
Published: 2025-07-24
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://fluidattacks.com/advisories/kino; https://github.com/gelbphoenix/autocaliweb; https://github.com/janeczku/calibre-web
CVE: CVE-2025-8123
Published: 2025-07-24
Description: A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been classified as critical. Affected is an unknown function of the file /system/dept/edit. The manipulation of the argument ancestors leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/deerwms/deer-wms-2/issues/ICLRFL; https://vuldb.com/?ctiid.317508; https://vuldb.com/?id.317508
CVE: CVE-2025-22165
Published: 2025-07-24
Description: This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac.

This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. 

Atlassian recommends that Sourcetree for Mac users upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://www.sourcetreeapp.com/download-archives .

You can download the latest version of Sourcetree for Mac from the download center https://www.sourcetreeapp.com/download-archives .

This vulnerability was found through the Atlassian Bug Bounty Program by Karol Mazurek (AFINE).
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://jira.atlassian.com/browse/SRCTREE-8217
CVE: CVE-2025-32429
Published: 2025-07-24
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101; https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq
CVE: CVE-2025-3614
Published: 2025-07-24
Description: The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.4.8/modules/widget-builder/controls/control-type-url.php#L9; https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.4.8/modules/widget-builder/controls/widget-writer.php#L366; https://www.wordfence.com/threat-intel/vulnerabilities/id/1627e235-7836-43dc-a3f6-7f79da6ab229?source=cve
CVE: CVE-2025-53940
Published: 2025-07-24
Description: Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1.
CWE: CWE-208
References: https://github.com/TryQuiet/quiet/issues/2820#issue[PII_REDACTED]; https://github.com/TryQuiet/quiet/pull/2928; https://github.com/TryQuiet/quiet/security/advisories/GHSA-gpw8-w78h-xj67
CVE: CVE-2025-54369
Published: 2025-07-24
Description: Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. This issue is fixed in version 5.1.0.
CWE: CWE-87, CWE-347
References: https://github.com/node-saml/node-saml/commit/31ead9411ebc3e2385086fa9149b6c17732bca10; https://github.com/node-saml/node-saml/releases/tag/v5.1.0; https://github.com/node-saml/node-saml/security/advisories/GHSA-m837-g268-mmv7
CVE: CVE-2025-54379
Published: 2025-07-24
Description: LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/lf-edge/ekuiper/commit/72c[PII_REDACTED]deebf04e324ae66933ec089ebd3; https://github.com/lf-edge/ekuiper/security/advisories/GHSA-526j-mv3p-f4vv; https://github.com/lf-edge/ekuiper/security/advisories/GHSA-526j-mv3p-f4vv
CVE: CVE-2025-0249
Published: 2025-07-25
Description: HCL IEM is affected by an improper invalidation of access or JWT token vulnerability.  A token was not invalidated which may allow attackers to access sensitive data without authorization.
CVSS Score: 3.3 (LOW)
CWE: CWE-287
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122368
CVE: CVE-2025-0250
Published: 2025-07-25
Description: HCL IEM is affected by an authorization token sent in cookie vulnerability.  A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks.
CVSS Score: 2.2 (LOW)
CWE: CWE-319
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122368
CVE: CVE-2025-7742
Published: 2025-07-25
Description: An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the devices non-volatile storage. This action may result in remote code execution that allows an attacker to run arbitrary commands on the target device at the administrator privilege level.
CWE: CWE-288
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-04
CVE: CVE-2025-8124
Published: 2025-07-25
Description: A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /system/role/authUser/unallocatedList. The manipulation of the argument params[dataScope] leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/deerwms/deer-wms-2/issues/ICLRF0; https://vuldb.com/?ctiid.317509; https://vuldb.com/?id.317509
CVE: CVE-2025-0251
Published: 2025-07-25
Description: HCL IEM is affected by a concurrent login vulnerability.  The application allows multiple concurrent sessions using the same user credentials, which may introduce security risks.
CVSS Score: 2.6 (LOW)
CWE: CWE-384
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122368
CVE: CVE-2025-0252
Published: 2025-07-25
Description: HCL IEM is affected by a password in cleartext vulnerability.  Sensitive information is transmitted without adequate protection, potentially exposing it to unauthorized access during transit.
CVSS Score: 2.6 (LOW)
CWE: CWE-319
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122368
CVE: CVE-2025-0253
Published: 2025-07-25
Description: HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabilities.
CVSS Score: 2.0 (LOW)
CWE: CWE-384
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122368
CVE: CVE-2025-54558
Published: 2025-07-25
Description: OpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-829
References: https://github.com/openai/codex/commit/6cf4b96f9dbbef8a94acc1ff703eb118481514d8; https://github.com/openai/codex/compare/rust-v0.8.0...rust-v0.9.0; https://github.com/openai/codex/pull/1644
CVE: CVE-2025-8125
Published: 2025-07-25
Description: A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /system/role/authUser/allocatedList. The manipulation of the argument params[dataScope] leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/deerwms/deer-wms-2/issues/ICLRE9; https://vuldb.com/?ctiid.317510; https://vuldb.com/?id.317510
CVE: CVE-2015-10143
Published: 2025-07-25
Description: The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the *_ajax_save_options() function in all versions up to 1.4.4 (exclusive). This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://blog.sucuri.net/2015/01/security-advisory-vulnerabilities-in-pagelinesplatform-theme-for-wordpress.html; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_platform_exec.rb; https://www.wordfence.com/threat-intel/vulnerabilities/id/c16fab08-6b2c-433a-9105-fc15f5c52575?source=cve
CVE: CVE-2015-10144
Published: 2025-07-25
Description: The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_responsive_thumbnail_slider_upload.rb; https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-thumbnail-carousel-slider-arbitrary-file-upload-1-0/
CVE: CVE-2019-25224
Published: 2025-07-25
Description: The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.sucuri.net/2019/06/os-command-injection-in-wp-database-backup.html; https://packetstormsecurity.com/files/153781/; https://plugins.trac.wordpress.org/changeset/2078035/wp-database-backup
CVE: CVE-2025-54566
Published: 2025-07-25
Description: hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-642
References: https://lore.kernel.org/qemu-devel/20250713-wmask-v1-1-4c744cdb32c0@rsg.ci.i.u-tokyo.ac.jp/
CVE: CVE-2025-54567
Published: 2025-07-25
Description: hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-684
References: https://lore.kernel.org/qemu-devel/20250713-wmask-v1-1-4c744cdb32c0@rsg.ci.i.u-tokyo.ac.jp/
CVE: CVE-2025-8126
Published: 2025-07-25
Description: A vulnerability classified as critical has been found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/user/export. The manipulation of the argument params[dataScope] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/deerwms/deer-wms-2/issues/ICLQUE; https://vuldb.com/?ctiid.317511; https://vuldb.com/?id.317511
CVE: CVE-2025-54568
Published: 2025-07-25
Description: Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node.
CVSS Score: 3.7 (LOW)
CWE: CWE-684
References: http://techdocs.akamai.com/app-api-protector/docs/improved-rate-accounting; https://github.com/geo-chen/Akamai/blob/main/Edge%20Hopping.md
CVE: CVE-2025-8127
Published: 2025-07-25
Description: A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. This vulnerability affects unknown code of the file /system/user/list. The manipulation of the argument params[dataScope] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/deerwms/deer-wms-2/issues/ICLQT8; https://vuldb.com/?ctiid.317512; https://vuldb.com/?id.317512
CVE: CVE-2025-8128
Published: 2025-07-25
Description: A vulnerability, which was classified as critical, has been found in zhousg letao up to 7d8df0386a[PII_REDACTED]0949e0413de48f7fbe98. This issue affects some unknown processing of the file routes\bf\product.js. The manipulation of the argument pictrdtz leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/zhousg/letao/issues/13; https://github.com/zhousg/letao/issues/13#issue[PII_REDACTED]; https://vuldb.com/?ctiid.317513
CVE: CVE-2025-8129
Published: 2025-07-25
Description: A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://github.com/koajs/koa/issues/1892; https://github.com/koajs/koa/issues/1892#issue[PII_REDACTED]; https://vuldb.com/?ctiid.317514
CVE: CVE-2025-8131
Published: 2025-07-25
Description: A vulnerability was found in Tenda AC20 16.03.08.05. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/Thir0th/Thir0th-CVE/blob/main/Tenda_AC20_V16.03.08.05_has_a_stack_overflow.md; https://vuldb.com/?ctiid.317527; https://vuldb.com/?id.317527
CVE: CVE-2025-8132
Published: 2025-07-25
Description: A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been rated as critical. Affected by this issue is the function delfile of the file app/extend/utils.js. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The name of the patch is c8a282bf02a62b59ec60b4699e91c51aff2ee9cd. It is recommended to upgrade the affected component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://gitee.com/yanyutao0402/ChanCMS/commit/c8a282bf02a62b59ec60b4699e91c51aff2ee9cd; https://gitee.com/yanyutao0402/ChanCMS/issues/ICLOT8; https://gitee.com/yanyutao0402/ChanCMS/issues/ICLOT8#note_43945209_link
CVE: CVE-2025-7022
Published: 2025-07-25
Description: The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/c1021763-075b-40c7-801d-b5519828aabe/; https://wpscan.com/vulnerability/c1021763-075b-40c7-801d-b5519828aabe/
CVE: CVE-2025-8133
Published: 2025-07-25
Description: A vulnerability classified as critical has been found in yanyutao0402 ChanCMS up to 3.1.2. This affects the function getArticle of the file app/modules/api/service/gather.js. The manipulation of the argument targetUrl leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The identifier of the patch is 3ef58a50e8b3c427b03c8cf3c9e19a79aa809be6. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://gitee.com/yanyutao0402/ChanCMS/commit/3ef58a50e8b3c427b03c8cf3c9e19a79aa809be6; https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP1K; https://gitee.com/yanyutao0402/ChanCMS/releases/tag/V3.1.3
CVE: CVE-2025-8134
Published: 2025-07-25
Description: A vulnerability classified as critical was found in PHPGurukul BP Monitoring Management System 1.0. This vulnerability affects unknown code of the file /bwdates-report-result.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/LagonGit/ReportCVE/issues/13; https://github.com/LagonGit/ReportCVE/issues/14; https://phpgurukul.com/
CVE: CVE-2025-5831
Published: 2025-07-25
Description: The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://droip.com/; https://www.wordfence.com/threat-intel/vulnerabilities/id/dd[PII_REDACTED]-4def-a07f-66f9178eeb77?source=cve