deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-6569
Published: 2024-07-27
Description: The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plugin not properly restricting direct access to /forms/views/admin/create.php and display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/forms-for-campaign-monitor/trunk/forms/views/admin/create.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3125580%40forms-for-campaign-monitor&new=3125580%40forms-for-campaign-monitor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/babf88c4-6328-4ba2-97e4-e1eaaa549dbb?source=cve
CVE: CVE-2024-5614
Published: 2024-07-27
Description: The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'pafe_posts_list' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and excerpts of future, draft, and pending blog posts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/piotnet-addons-for-elementor/trunk/inc/ajax-posts-list.php#L4; https://plugins.trac.wordpress.org/changeset/3125094/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2880cde0-a278-4a41-97f7-c54c2b3aceb2?source=cve
CVE: CVE-2024-6518
Published: 2024-07-27
Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via input fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3125227/; https://wordpress.org/plugins/fluentform/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/66ca9c39-1ba0-4208-ae35-d2c3c9ea4eb9?source=cve
CVE: CVE-2024-6520
Published: 2024-07-27
Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom error message in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3125227/; https://wordpress.org/plugins/fluentform/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a30d35c-9883-4b0f-83a2-494401c45d8e?source=cve
CVE: CVE-2024-6521
Published: 2024-07-27
Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dropdown fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3125227/; https://wordpress.org/plugins/fluentform/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/be7c6cfa-6cac-46d2-8eb9-9fef8049f6e7?source=cve
CVE: CVE-2024-6627
Published: 2024-07-27
Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's PDF View widget in all versions up to, and including, 3.11.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/widgets/pdf-view/widget.php#L587; https://plugins.trac.wordpress.org/changeset/3124446/; https://wordpress.org/plugins/happy-elementor-addons/#developers
CVE: CVE-2024-6897
Published: 2024-07-27
Description: The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/athemes-starter-sites/trunk/v2/classes/class-importer.php#L65; https://plugins.trac.wordpress.org/changeset/3124434/; https://wordpress.org/plugins/athemes-starter-sites/#developers
CVE: CVE-2024-6703
Published: 2024-07-27
Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ and 'btn_txt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Manager permissions and Subscriber+ user role, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FluentConversational/Classes/Elements/WelcomeScreen.php; https://plugins.trac.wordpress.org/changeset/3125227/; https://www.wordfence.com/threat-intel/vulnerabilities/id/69dc9236-8079-434f-b2b5-060a0c5eba46?source=cve
CVE: CVE-2024-7151
Published: 2024-07-27
Description: A vulnerability was found in Tenda O3 1.0.0.10(2478). It has been declared as critical. This vulnerability affects the function fromMacFilterSet of the file /goform/setMacFilter. The manipulation of the argument remark leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-272554 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/fromMacFilterSet.md; https://vuldb.com/?ctiid.272554; https://vuldb.com/?id.272554
CVE: CVE-2024-7152
Published: 2024-07-27
Description: A vulnerability was found in Tenda O3 1.0.0.10(2478). It has been rated as critical. This issue affects the function fromSafeSetMacFilter of the file /goform/setMacFilterList. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272555. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/fromSafeSetMacFilter.md; https://vuldb.com/?ctiid.272555; https://vuldb.com/?id.272555
CVE: CVE-2024-7153
Published: 2024-07-27
Description: A vulnerability classified as problematic has been found in Netgear WN604 up to 20240719. Affected is an unknown function of the file siteSurvey.php. The manipulation leads to direct request. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272556. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://vuldb.com/?ctiid.272556; https://vuldb.com/?id.272556; https://vuldb.com/?submit.377056
CVE: CVE-2024-42049
Published: 2024-07-28
Description: TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://sourceforge.net/p/vnc-tight/bugs/1629/; https://www.tightvnc.com/whatsnew.php; https://sourceforge.net/p/vnc-tight/bugs/1629/
CVE: CVE-2024-42050
Published: 2024-07-28
Description: The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM via an oplock on CredProvider_Inst.reg.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/4.md; https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/[PII_REDACTED]2571--Splashtop-Streamer-version-v3-7-0-0-for-Windows-released; https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/4.md
CVE: CVE-2024-42051
Published: 2024-07-28
Description: The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by replacing InstRegExp.reg.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1391
References: https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/3.md; https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/[PII_REDACTED]6763-Splashtop-Streamer-version-v3-6-2-0-for-Windows-released; https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/3.md
CVE: CVE-2024-42052
Published: 2024-07-28
Description: The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by placing a wevtutil.exe file in the folder.
CVSS Score: 7.8 (HIGH)
CWE: CWE-378
References: https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/1.md; https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/[PII_REDACTED]603-Splashtop-Streamer-version-v3-5-8-0-for-Windows-released; https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/1.md
CVE: CVE-2024-42053
Published: 2024-07-28
Description: The MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by placing a version.dll file in the folder.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md; https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/[PII_REDACTED]539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released; https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md
CVE: CVE-2024-42054
Published: 2024-07-28
Description: Cervantes through 0.5-alpha accepts insecure file uploads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/CervantesSec/cervantes/commit/78631a034d0fb3323a53fb7428b2022b29a0d2cd; https://www.getastra.com/blog/vulnerability/xss-insecure-file-cervantes/; https://www.jinsonvarghese.com/stored-xss-file-upload-vulnerabilities-found-in-cervantes/
CVE: CVE-2024-42055
Published: 2024-07-28
Description: Cervantes through 0.5-alpha allows stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/CervantesSec/cervantes/commit/78631a034d0fb3323a53fb7428b2022b29a0d2cd; https://www.getastra.com/blog/vulnerability/xss-insecure-file-cervantes/; https://www.jinsonvarghese.com/stored-xss-file-upload-vulnerabilities-found-in-cervantes/
CVE: CVE-2024-7154
Published: 2024-07-28
Description: A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.html of the component Password Reset Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272568. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-306
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3700R/setWizardCfg_changepw.md; https://vuldb.com/?ctiid.272568; https://vuldb.com/?id.272568
CVE: CVE-2024-7155
Published: 2024-07-28
Description: A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-272569 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.5 (LOW)
CWE: CWE-259, CWE-798
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3300R/shadow.md; https://vuldb.com/?ctiid.272569; https://vuldb.com/?id.272569
CVE: CVE-2024-7156
Published: 2024-07-28
Description: A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/ExportSettings.sh of the component apmib Configuration Handler. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272570 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3700R/ExportSettings.md; https://vuldb.com/?ctiid.272570; https://vuldb.com/?id.272570
CVE: CVE-2024-7157
Published: 2024-07-28
Description: A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been classified as critical. This affects the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The manipulation of the argument http_host leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272571. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3100R/getSaveConfig.md; https://vuldb.com/?ctiid.272571; https://vuldb.com/?id.272571
CVE: CVE-2024-7158
Published: 2024-07-28
Description: A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnet_enabled leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272572. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3100R/setTelnetCfg.md; https://vuldb.com/?ctiid.272572; https://vuldb.com/?id.272572
CVE: CVE-2024-7159
Published: 2024-07-28
Description: A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been rated as critical. This issue affects some unknown processing of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier VDB-272573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-259
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/product.md; https://vuldb.com/?ctiid.272573; https://vuldb.com/?id.272573
CVE: CVE-2024-7160
Published: 2024-07-28
Description: A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3700R/setWanCfg.md; https://vuldb.com/?ctiid.272574; https://vuldb.com/?id.272574
CVE: CVE-2024-7161
Published: 2024-07-28
Description: A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=chgpwdsubmit of the component Password Change Handler. The manipulation of the argument newpwd/newpwd2 leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272575.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/HuaQiPro/seacms/issues/30; https://vuldb.com/?ctiid.272575; https://vuldb.com/?id.272575
CVE: CVE-2024-7162
Published: 2024-07-28
Description: A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionality of the file js/player/dmplayer/admin/post.php?act=setting. The manipulation of the argument yzm leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272576.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/HuaQiPro/seacms/issues/29; https://vuldb.com/?ctiid.272576; https://vuldb.com/?id.272576
CVE: CVE-2024-7163
Published: 2024-07-28
Description: A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php. The manipulation of the argument color/vid/url leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272577 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/HuaQiPro/seacms/issues/28; https://vuldb.com/?ctiid.272577; https://vuldb.com/?id.272577
CVE: CVE-2024-7164
Published: 2024-07-28
Description: A vulnerability has been found in SourceCodester School Fees Payment System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=login. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-272578 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://gist.github.com/topsky979/d53eab0322b187bfe151b3f1f31958e2; https://vuldb.com/?ctiid.272578; https://vuldb.com/?id.272578
CVE: CVE-2024-7165
Published: 2024-07-28
Description: A vulnerability was found in SourceCodester School Fees Payment System 1.0 and classified as critical. This issue affects some unknown processing of the file /view_payment.php. The manipulation of the argument ef_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272579.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/efe8fa56e557bf3244909f348d5874f7; https://vuldb.com/?ctiid.272579; https://vuldb.com/?id.272579
CVE: CVE-2024-7166
Published: 2024-07-28
Description: A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been classified as critical. Affected is an unknown function of the file /receipt.php. The manipulation of the argument ef_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272580.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/8ab4ff5ffb2a555694931d14329f5a5d; https://vuldb.com/?ctiid.272580; https://vuldb.com/?id.272580
CVE: CVE-2024-7167
Published: 2024-07-28
Description: A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /manage_course.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272581 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/69a797bc0b33fc19144a727a0be31685; https://vuldb.com/?ctiid.272581; https://vuldb.com/?id.272581
CVE: CVE-2024-7168
Published: 2024-07-28
Description: A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272582 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/14187eec46d6bc04772eadae7ac4e930; https://vuldb.com/?ctiid.272582; https://vuldb.com/?id.272582
CVE: CVE-2024-7169
Published: 2024-07-28
Description: A vulnerability classified as problematic has been found in SourceCodester School Fees Payment System 1.0. This affects an unknown part of the file /ajax.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272583.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/topsky979/421c916be6ab09dc990896b07185ec89; https://vuldb.com/?ctiid.272583; https://vuldb.com/?id.272583