deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-44180
Published: 2025-05-15
Description: Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nscerol/Vehicle-Record-Management-System/blob/main/CVE-2025-44180-Vehicle-Record-Management-System-1.0-Stored-Cross-Site-Scripting-Vulnerability.md; https://phpgurukul.com/vehicle-record-system-using-php-and-mysql/; https://github.com/nscerol/Vehicle-Record-Management-System/blob/main/CVE-2025-44180-Vehicle-Record-Management-System-1.0-Stored-Cross-Site-Scripting-Vulnerability.md
CVE: CVE-2025-44181
Published: 2025-05-15
Description: Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/add-brand.php via the brandname parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nscerol/Vehicle-Record-Management-System/blob/main/CVE-2025-44181-Vehicle-Record-Management-System-1.0-Stored-Cross-Site-Scripting-Vulnerability.md; https://phpgurukul.com/vehicle-record-system-using-php-and-mysql/
CVE: CVE-2025-44182
Published: 2025-05-15
Description: Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum, enginenumber' in the /admin/edit-vehicle.php component. This allows attackers to execute arbitrary code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://phpgurukul.com/vehicle-record-system-using-php-and-mysql/
CVE: CVE-2025-44183
Published: 2025-05-15
Description: Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the name, email, and mobile parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nscerol/Vehicle-Record-Management-System/blob/main/CVE-2025-44183-Vehicle-Record-Management-System-1.0-Stored-Cross-Site-Scripting-Vulnerability.md; https://phpgurukul.com/vehicle-record-system-using-php-and-mysql/; https://phpgurukul.com/vehicle-record-system-using-php-and-mysql/
CVE: CVE-2025-46052
Published: 2025-05-15
Description: An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/johnchd/CVEs/blob/main/WebERP/CVE-2025-46052%20-%20SQLi.md; https://www.weberp.org/; https://github.com/johnchd/CVEs/blob/main/WebERP/CVE-2025-46052%20-%20SQLi.md
CVE: CVE-2025-4516
Published: 2025-05-15
Description: There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.
CWE: CWE-416
References: https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292; https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d; https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142
CVE: CVE-2025-4698
Published: 2025-05-15
Description: A vulnerability classified as critical has been found in PHPGurukul Directory Management System 2.0. This affects an unknown part of the file /admin/forget-password.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lwecho/myCVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.308997
CVE: CVE-2025-4699
Published: 2025-05-15
Description: A vulnerability classified as critical was found in PHPGurukul Apartment Visitors Management System 1.0. This vulnerability affects unknown code of the file /admin/visitors-form.php. The manipulation of the argument Category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/y77-88/myCVE/issues/10; https://phpgurukul.com/; https://vuldb.com/?ctiid.308998
CVE: CVE-2025-44185
Published: 2025-05-15
Description: SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change_pass.php via the password parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/cumakurt/CVE-SourceCodester-Best-Employee-Management-System-1.0/blob/main/CVE-2025-44185-SourceCodester-Best-Employee-Management-System-1.0-CSRF-in-Password-Change.md; https://www.sourcecodester.com/php/17689/best-employee-management-system-php.html; https://www.sourcecodester.com/sites/default/files/download/mayuri_k/_hr_soft_updated.zip
CVE: CVE-2025-46053
Published: 2025-05-15
Description: A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.php
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89
References: https://github.com/johnchd/CVEs/blob/main/WebERP/CVE-2025-46053%20-%20SQLi.md; https://www.weberp.org/
CVE: CVE-2025-4701
Published: 2025-05-15
Description: A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the file models/utils.py. The manipulation of the argument path leads to deserialization. It is possible to launch the attack on the local host.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://github.com/VITA-MLLM/Freeze-Omni/issues/29; https://vuldb.com/?ctiid.308999; https://vuldb.com/?id.308999
CVE: CVE-2025-4702
Published: 2025-05-15
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Vehicle Parking Management System 1.13. Affected is an unknown function of the file /admin/add-category.php. The manipulation of the argument catename leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/baixiaobai001/myCVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.309000
CVE: CVE-2024-52877
Published: 2025-05-15
Description: An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, callback function SmmCreateVariableLockList () calls CreateVariableLockListInSmm (). In CreateVariableLockListInSmm (), it uses StrSize () to get variable name size and it could lead to a buffer over-read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/sa-2024016/
CVE: CVE-2024-52878
Published: 2025-05-15
Description: An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, VariableServicesSetVariable () can be called by gRT_>SetVariable () or the SmmSetSensitiveVariable () or SmmInternalSetVariable () from SMM. In VariableServicesSetVariable (), it uses StrSize () to get variable name size, uses StrLen () to get variable name length and uses StrCmp () to compare strings. These actions may cause a buffer over-read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/sa-2024016/
CVE: CVE-2024-52879
Published: 2025-05-15
Description: An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SmmUpdateVariablePropertySmi () is a SMM callback function and it uses StrCmp () to compare variable names. This action may cause a buffer over-read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/sa-2024016/
CVE: CVE-2024-52880
Published: 2025-05-15
Description: An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SecureBootHandler uses DataSize and VariableNameSize when determining if the data or name are in the buffer, but these are supplied by the caller and therefore cannot be trusted.
CVSS Score: 7.9 (HIGH)
CWE: CWE-20
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/sa-2024016/
CVE: CVE-2025-2527
Published: 2025-05-15
Description: Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view group information via an API request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-2570
Published: 2025-05-15
Description: Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console.
CVSS Score: 2.7 (LOW)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-3440
Published: 2025-05-15
Description: IBM Security Guardium 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7233600
CVE: CVE-2025-48050
Published: 2025-05-15
Description: In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."
CVSS Score: 7.5 (HIGH)
CWE: CWE-24
References: https://github.com/cure53/DOMPurify/commit/6bc6d60e49256f27a4022181b7d8a5b0721fd534; https://github.com/cure53/DOMPurify/pull/1101; https://github.com/odaysec/advisory/blob/main/cure53/DOMPurify/writeup.md
CVE: CVE-2025-48051
Published: 2025-05-15
Description: powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/lichess-org/lila/blob/7b82f35d15f9113ac8a0a9271d34bef4f6119e9f/ui/site/src/powertip.ts#L60; https://github.com/lichess-org/lila/commit/ab0beaf0ad671761705d9274663c5dc450608527; https://github.com/lichess-org/lila/security/advisories/GHSA-9xhx-p3c5-p4v6
CVE: CVE-2025-4703
Published: 2025-05-15
Description: A vulnerability has been found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument contactnumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/baixiaobai001/myCVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.309001
CVE: CVE-2025-4704
Published: 2025-05-15
Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/edit-category.php. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/baixiaobai001/myCVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.309002
CVE: CVE-2025-4705
Published: 2025-05-15
Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been classified as critical. This affects an unknown part of the file /admin/view-incomingvehicle-detail.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/baixiaobai001/myCVE/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.309003
CVE: CVE-2025-1647
Published: 2025-05-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-79
References: https://www.herodevs.com/vulnerability-directory/cve-2025-1647; https://lists.debian.org/debian-lts-announce/2025/06/msg00001.html
CVE: CVE-2025-30417
Published: 2025-05-15
Description: There is a memory corruption vulnerability due to an out of bounds write in Library!DecodeBase64() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-circuit-design-suite.html
CVE: CVE-2025-30418
Published: 2025-05-15
Description: There is a memory corruption vulnerability due to an out of bounds write in CheckPins() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-circuit-design-suite.html
CVE: CVE-2025-30419
Published: 2025-05-15
Description: There is a memory corruption vulnerability due to an out of bounds read in GetSymbolBorderRectSize() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-circuit-design-suite.html
CVE: CVE-2025-30420
Published: 2025-05-15
Description: There is a memory corruption vulnerability due to an out of bounds read in Bitmap::InternalDraw() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-circuit-design-suite.html
CVE: CVE-2025-30421
Published: 2025-05-15
Description: There is a memory corruption vulnerability due to a stack-based buffer overflow in DrObjectStorage::XML_Serialize() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-circuit-design-suite.html
CVE: CVE-2025-47580
Published: 2025-05-15
Description: Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through <= 3.2.35.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/front-end-only-users/vulnerability/wordpress-front-end-users-plugin-3-2-32-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-4706
Published: 2025-05-15
Description: A vulnerability was found in projectworlds Online Examination System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Procedure3b_yearwiseVisit.php. The manipulation of the argument Visit_year leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Welhelm666/666/issues/2; https://vuldb.com/?ctiid.309004; https://vuldb.com/?id.309004
CVE: CVE-2025-4707
Published: 2025-05-15
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /pages/transaction_add.php. The manipulation of the argument prod_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lanxia0/CVE/issues/1; https://vuldb.com/?ctiid.309005; https://vuldb.com/?id.309005
CVE: CVE-2025-4708
Published: 2025-05-15
Description: A vulnerability classified as critical has been found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/sales_add.php. The manipulation of the argument discount leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lanxia0/CVE/issues/2; https://vuldb.com/?ctiid.309006; https://vuldb.com/?id.309006
CVE: CVE-2025-43853
Published: 2025-05-15
Description: The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-uvwasi on Windows is affected by a symlink following vulnerability. On WAMR running in Windows, creating a symlink pointing outside of the preopened directory and subsequently opening it with create flag will create a file on host outside of the sandbox. If the symlink points to an existing host file, it's also possible to open it and read its content. Version 2.3.0 fixes the issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-61
References: https://github.com/bytecodealliance/wasm-micro-runtime/commit/28702edaf739cdeee54e81efe5868bf00724c33c; https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-8fc8-4g25-c8m7
CVE: CVE-2025-44110
Published: 2025-05-15
Description: FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstorm.news/files/id/189672/
CVE: CVE-2025-47279
Published: 2025-05-15
Description: Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
CVSS Score: 3.1 (LOW)
CWE: CWE-401
References: https://github.com/nodejs/undici/commit/f317618ec28753a4218beccea048bcf89c36db25; https://github.com/nodejs/undici/issues/3895; https://github.com/nodejs/undici/pull/4088
CVE: CVE-2025-47285
Published: 2025-05-15
Description: Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b""`; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. `b"" if self.do_some_side_effect() else b""`. The fix is available in pull request 4644 and expected to be part of the 0.4.2 release. As a workaround, don't have side effects in expressions which construct zero-length bytestrings.
CWE: CWE-691
References: https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b[PII_REDACTED]b8a6eaa316/vyper/builtins/functions.py#L560-L562; https://github.com/vyperlang/vyper/pull/4644; https://github.com/vyperlang/vyper/security/advisories/GHSA-qhr6-mgqr-mchm
CVE: CVE-2025-47774
Published: 2025-05-15
Description: Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `<address>.code`). The reason is that for these source locations, the check that `length >= 1` is skipped. The result is that a 0-length bytestring constructed with slice can be passed to `make_byte_array_copier`, which elides evaluation of its source argument when the max length is 0. The impact is that side effects in the `start` argument may be elided when the `length` argument is 0, e.g. `slice(msg.data, self.do_side_effect(), 0)`. The fix in pull request 4645 disallows any invocation of `slice()` with length 0, including for the ad hoc locations discussed in this advisory. The fix is expected to be part of version 0.4.2.
CWE: CWE-691
References: https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b[PII_REDACTED]b8a6eaa316/vyper/builtins/functions.py#L315-L319; https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b[PII_REDACTED]b8a6eaa316/vyper/codegen/core.py#L189-L191; https://github.com/vyperlang/vyper/pull/4645