deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-62712
Published: 2025-10-30
Description: JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts, an authenticated, non-privileged user can retrieve connection tokens belonging to other users via the super-connection API endpoint (/api/v1/authentication/super-connection-token/). When accessed from a web browser, this endpoint returns connection tokens created by all users instead of restricting results to tokens owned by or authorized for the requester. An attacker who obtains these tokens can use them to initiate connections to managed assets on behalf of the original token owners, resulting in unauthorized access and privilege escalation across sensitive systems. This vulnerability is fixed in v3.10.20-lts and v4.10.11-lts.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-862
References: https://github.com/jumpserver/jumpserver/commit/453ad331eec9d9667a38de735d6612608e558491; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-6ghx-6vpv-3wg7
CVE: CVE-2025-12060
Published: 2025-10-30
Description: The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special symlinks, which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness, identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517 (e.g. Python 3.13.4) is not enough. One additionally needs to upgrade Keras to a version with the fix (Keras 3.12).
CWE: CWE-22
References: https://github.com/keras-team/keras/pull/21760; https://github.com/keras-team/keras/security/advisories/GHSA-hjqc-jx6g-rwp9
CVE: CVE-2025-60319
Published: 2025-10-30
Description: PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/PerfreeBlog/PerfreeBlog/commit/103c79165e3a41a1729188fdc8a1e90c97c0a06d; https://github.com/PerfreeBlog/PerfreeBlog/issues/20
CVE: CVE-2025-60950
Published: 2025-10-30
Description: An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary code via a crafted SVG file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://app.aixblock.io/temp/dbdf9e79_payload1.svg; https://github.com/AIxBlock-2023/awesome-ai-dev-platform-opensource/issues/101; https://github.com/AIxBlock-2023/awesome-ai-dev-platform-opensource/pull/172/commits/f60975d58215db83d5d111bd50a86e269c228081
CVE: CVE-2025-61114
Published: 2025-10-30
Description: 2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper access control vulnerability in its authentication mechanism. The server only validates the first character of the user_token, enabling attackers to brute force tokens and perform unauthorized queries on other user accounts. Successful exploitation could result in privacy breaches and unauthorized access to user data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://kar1oz.notion.site/2nd-Line-2629a473ecb280739ecac2d316da666c
CVE: CVE-2025-61119
Published: 2025-10-30
Description: Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful exploitation could result in privacy breaches, unauthorized group access, and misuse of the platform.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://kar1oz.notion.site/Kanova-2629a473ecb2801bac89ce99d0b30df7
CVE: CVE-2025-61120
Published: 2025-10-30
Description: AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., contains improper access control vulnerabilities. Exposed credentials in traffic may allow attackers to misuse cloud resources, and predictable verification codes make brute-force account logins feasible. Successful exploitation could result in account compromise, privacy breaches, and abuse of cloud resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://kar1oz.notion.site/AG-Life-Logger-2629a473ecb280c693e7d5d4a99de559
CVE: CVE-2025-61121
Published: 2025-10-30
Description: Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerability. Improper handling of cloud service credentials may allow attackers to obtain them and carry out unauthorized actions, such as sensitive information disclosure and abuse of cloud resources. Successful exploitation could result in privacy breaches and misuse of the platform infrastructure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-523
References: https://kar1oz.notion.site/Mobile-Scanner-2659a473ecb28058a9f3e06cff61781c
CVE: CVE-2025-61196
Published: 2025-10-30
Description: An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/zsamamah/CVE-2025-61196/blob/main/CVE-2025-61196.md; https://github.com/zsamamah/CVE-2025-61196/blob/main/CVE-2025-61196.md
CVE: CVE-2025-62726
Published: 2025-10-30
Description: n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution. This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows. This vulnerability is fixed in 1.113.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829
References: https://github.com/n8n-io/n8n/commit/5bf3db5ba84d3195bbe11bbd3c62f7086e090997; https://github.com/n8n-io/n8n/pull/19559; https://github.com/n8n-io/n8n/security/advisories/GHSA-xgp7-7qjq-vg47
CVE: CVE-2025-62795
Published: 2025-10-30
Description: JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket endpoint, bypassing authorization checks and potentially exposing LDAP credentials or causing unintended sync operations. This vulnerability is fixed in v3.10.21-lts and v4.10.12-lts.
CVSS Score: 7.1 (HIGH)
CWE: CWE-863
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7893-256g-m822; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7893-256g-m822
CVE: CVE-2025-63885
Published: 2025-10-30
Description: A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the model_desc field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AIxBlock-2023/awesome-ai-dev-platform-opensource/issues/278%2C; https://github.com/AIxBlock-2023/awesome-ai-dev-platform-opensource/pull/280/commits/04f3051187b884973beb42316489e3fb37116fdf
CVE: CVE-2025-64096
Published: 2025-10-30
Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to 1.4.2, there is a missing bounds check in Crypto_Key_update() (crypto_key_mgmt.c) which allows a remote attacker to trigger a stack-based buffer overflow by supplying a TLV packet with a spoofed length field. The function calculates the number of keys from an attacker-controlled field (pdu_len), which may exceed the static array size (kblk[98]), leading to an out-of-bounds write and potential memory corruption. This vulnerability is fixed in 1.4.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/nasa/CryptoLib/security/advisories/GHSA-w6c3-pxvr-6m6j; https://github.com/nasa/CryptoLib/security/advisories/GHSA-w6c3-pxvr-6m6j
CVE: CVE-2025-56313
Published: 2025-10-30
Description: A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). This allows remote attackers to execute arbitrary JavaScript in a user's web browser by including a malicious payload in the "code" URL parameter. When an authenticated admin user accesses the study's URL, the malicious script gets interpreted and executes within their browser, which can lead to unauthorized actions, account compromise, and privilege escalation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/JATOS/JATOS; https://medium.com/@ruizramisdaniel/cve-2025-56313-jatos-v3-9-6-reflected-xss-in-study-links-af1305ae09d0; https://medium.com/@ruizramisdaniel/cve-2025-56313-jatos-v3-9-6-reflected-xss-in-study-links-af1305ae09d0
CVE: CVE-2025-62266
Published: 2025-10-30
Description: By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256
CVE: CVE-2025-64112
Published: 2025-10-30
Description: Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fixed in 5.22.1.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1; https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
CVE: CVE-2025-64115
Published: 2025-10-30
Description: Movary is a web application to track, rate and explore your movie watch history. Versions up to and including 0.68.0 use the HTTP Referer header value directly for redirects in multiple settings endpoints, allowing a crafted link to cause an open redirect to an attacker-controlled site and facilitate phishing. This vulnerability is fixed in 0.69.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/leepeuker/movary/commit/716f703b4464ffdb0365c406f3660d275495769f; https://github.com/leepeuker/movary/pull/713; https://github.com/leepeuker/movary/security/advisories/GHSA-pm58-79jw-q79f
CVE: CVE-2025-64116
Published: 2025-10-30
Description: Movary is a web application to track, rate and explore your movie watch history. Prior to 0.69.0, the login page accepts a redirect parameter without validation, allowing attackers to redirect authenticated users to arbitrary external sites. This vulnerability is fixed in 0.69.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/leepeuker/movary/commit/716f703b4464ffdb0365c406f3660d275495769f; https://github.com/leepeuker/movary/pull/713; https://github.com/leepeuker/movary/security/advisories/GHSA-7q72-x26x-7f8g
CVE: CVE-2025-64118
Published: 2025-10-30
Description: node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.
CWE: CWE-362, CWE-367
References: https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d; https://github.com/isaacs/node-tar/issues/445; https://github.com/isaacs/node-tar/pull/446
CVE: CVE-2025-36137
Published: 2025-10-30
Description: IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns permissions for maintenance tasks to Control Center Director (CCD) users that could allow a privileged user to escalate their privileges further due to unnecessary privilege assignment for post update scripts.
CVSS Score: 7.2 (HIGH)
CWE: CWE-250
References: https://www.ibm.com/support/pages/node/7249678
CVE: CVE-2025-52179
Published: 2025-10-30
Description: Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahrw/jsp/gsfr_feditorHTML.jsp endpoint.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/alex-xor/8d0f9f456e6840a955889305ea789ef8; https://www.zucchetti.it/
CVE: CVE-2025-52180
Published: 2025-10-30
Description: Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource endpoint.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/alex-xor/8d0f9f456e6840a955889305ea789ef8; https://www.zucchetti.it/
CVE: CVE-2025-57109
Published: 2025-10-30
Description: Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene node references, the application accesses string members of mesh objects that have been previously freed during actor import operations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://gitlab.kitware.com/vtk/vtk/-/issues/19735
CVE: CVE-2025-62265
Published: 2025-10-30
Description: Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's “Content” text field 

The Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62265
CVE: CVE-2025-63298
Published: 2025-10-30
Description: A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php component. An authenticated user with administrative privileges can leverage this flaw by submitting a specially crafted POST request, enabling the deletion of arbitrary files on the web server or underlying operating system.
CVSS Score: 8.2 (HIGH)
CWE: CWE-24
References: https://github.com/z3rObyte/CVE-2025-63298; https://www.sourcecodester.com/sites/default/files/download/mayuri_k/petgrooming_erp.zip
CVE: CVE-2025-63422
Published: 2025-10-30
Description: Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to arbitrarily change the administrator username and password via sending a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/5ulfur/security-advisories/tree/main/CVE-2025-63422; https://imgur.com/a/X9DNOBj
CVE: CVE-2025-3355
Published: 2025-10-30
Description: IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.ibm.com/support/pages/node/7249694
CVE: CVE-2025-3356
Published: 2025-10-30
Description: IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view, overwrite, or append to arbitrary files on the system.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://www.ibm.com/support/pages/node/7249694
CVE: CVE-2025-61141
Published: 2025-10-30
Description: sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://advisory.dw1.io/54/; https://github.com/sqls-server/sqls/; https://lukmanern.github.io/CVE-2025-61141.html
CVE: CVE-2025-61498
Published: 2025-10-30
Description: A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: http://tenda.com; https://github.com/sakshi-garg02/CVEs/tree/main/CVE-2025-61498
CVE: CVE-2025-63423
Published: 2025-10-30
Description: Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/5ulfur/security-advisories/tree/main/CVE-2025-63423; https://imgur.com/a/X9DNOBj
CVE: CVE-2025-8850
Published: 2025-10-30
Description: In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint '/api/auth/2fa/disable' is directly accessed. This flaw can be exploited by authenticated users to weaken the security of their own accounts, although it does not lead to full account compromise.
CVSS Score: 8.8 (HIGH)
CWE: CWE-440
References: https://github.com/danny-avila/librechat/commit/7e4c8a5d0d2dbe5bf8fd272ff6acafb27d24744f; https://huntr.com/bounties/8e615709-f4de-41e2-b194-f0d91ed7c75e
CVE: CVE-2011-10035
Published: 2025-10-30
Description: Nagios XI versions prior to 2011R1.9 contain privilege escalation vulnerabilities in the scripts that install or update system crontab entries. Due to time-of-check/time-of-use race conditions and missing synchronization or final-path validation, a local low-privileged user could manipulate filesystem state during crontab installation to influence the files or commands executed with elevated privileges, resulting in execution with higher privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-race-conditions-in-crontab-install-script-lpe
CVE: CVE-2011-10036
Published: 2025-10-30
Description: Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of the "backend_url" JavaScript link. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-backend-url-javascript-link-handler
CVE: CVE-2011-10037
Published: 2025-10-30
Description: Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of xiwindow variables used to build permalinks in the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://0a29.blogspot.com/2011/12/0a29-11-3-cross-site-scripting.html; https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-xiwindow-variables-affecting-permalinks
CVE: CVE-2011-10038
Published: 2025-10-30
Description: Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the recurring downtime script of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-recurring-downtime-scripts
CVE: CVE-2011-10039
Published: 2025-10-30
Description: Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the Alert Heatmap report and the “My Reports” listing of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-alert-heatmap-report-and-my-reports-listing
CVE: CVE-2011-10040
Published: 2025-10-30
Description: Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the link-handling functions used by status and report pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-via-status-report-page-link-functions
CVE: CVE-2012-10063
Published: 2025-10-30
Description: Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-in-legacy-ccm
CVE: CVE-2013-10071
Published: 2025-10-30
Description: Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-reflected-xss-via-dashlet-ajax-load-functionality