deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-40899
Published: 2023-08-24
Description: Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFilterCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/ac8/formSetMacFilterCfg/1.md; https://github.com/peris-navince/founded-0-days/blob/main/ac8/formSetMacFilterCfg/1.md
CVE: CVE-2023-40900
Published: 2023-08-24
Description: Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/ac8/formSetQosBand/1.md; https://github.com/peris-navince/founded-0-days/blob/main/ac8/formSetQosBand/1.md
CVE: CVE-2023-40901
Published: 2023-08-24
Description: Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at url /goform/setMacFilterCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/ac10/formSetMacFilterCfg/1.md; https://github.com/peris-navince/founded-0-days/blob/main/ac10/fromSetStaticRouteCfg/1.md; https://nvd.nist.gov/vuln/detail/CVE-2023-40901
CVE: CVE-2023-40902
Published: 2023-08-24
Description: Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/ac10/SetIpMacBind/1.md; https://github.com/peris-navince/founded-0-days/blob/main/ac10/SetIpMacBind/1.md
CVE: CVE-2023-40904
Published: 2023-08-24
Description: Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFilterCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/ac10/formSetMacFilterCfg/1.md; https://github.com/peris-navince/founded-0-days/blob/main/ac10/formSetMacFilterCfg/1.md
CVE: CVE-2023-31412
Published: 2023-08-24
Description: The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. If an attacker manages to retrieve the hash, it could lead to collision attacks and the potential retrieval of the password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.pdf; https://sick.com/psirt
CVE: CVE-2023-4418
Published: 2023-08-24
Description: A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-service (DDoS) attack. 
By exploiting this vulnerability, an attacker can flood the targeted LMS5xx with a high volume of TCP SYN requests, overwhelming its resources and causing it to become unresponsive or unavailable for legitimate users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.pdf; https://sick.com/psirt
CVE: CVE-2023-4419
Published: 2023-08-24
Description: The LMS5xx uses hard-coded credentials, which potentially allow low-skilled
unauthorized remote attackers to reconfigure settings and /or disrupt the functionality of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.pdf; https://sick.com/psirt
CVE: CVE-2023-4420
Published: 2023-08-24
Description: A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security (TLS) in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can exploit this weakness to eavesdrop on the communication between the LMS5xx and the Client, and potentially manipulate the data being transmitted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-311
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0007.pdf; https://sick.com/psirt
CVE: CVE-2023-39801
Published: 2023-08-24
Description: A lack of exception handling in the Renault Easy Link Multimedia System Software Version 283C35519R allows attackers to cause a Denial of Service (DoS) via supplying crafted WMA files when connecting a device to the vehicle's USB plug and play feature.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-755
References: https://github.com/zj3t/Automotive-vulnerabilities/blob/main/RENAULT/ZOE_EV_2021/Vuln%232/README.md; https://github.com/zj3t/Automotive-vulnerabilities/blob/main/RENAULT/ZOE_EV_2021/Vuln%232/README.md
CVE: CVE-2023-32077
Published: 2023-08-24
Description: Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6.  If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-321, CWE-798
References: https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51; https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657; https://github.com/gravitl/netmaker/pull/2170
CVE: CVE-2023-32078
Published: 2023-08-24
Description: Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user update function. By specifying another user's username, it was possible to update the other user's password. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/gravitl/netmaker/commit/b3be57c65bf0bbfab43b66853c8e3637a43e2839; https://github.com/gravitl/netmaker/pull/2158; https://github.com/gravitl/netmaker/security/advisories/GHSA-256m-j5qw-38f4
CVE: CVE-2023-32079
Published: 2023-08-24
Description: Netmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escalate privileges to those of an admin user. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-915
References: https://github.com/gravitl/netmaker/security/advisories/GHSA-826j-8wp2-4x6q; https://github.com/gravitl/netmaker/security/advisories/GHSA-826j-8wp2-4x6q
CVE: CVE-2023-37469
Published: 2023-08-24
Description: CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/IceWhaleTech/CasaOS/blob/96e[PII_REDACTED]0098c771bc41fd3baf46189b859/route/v1/samba.go#L121; https://github.com/IceWhaleTech/CasaOS/blob/96e[PII_REDACTED]0098c771bc41fd3baf46189b859/service/connections.go#L58; https://github.com/IceWhaleTech/CasaOS/commit/af440eac[PII_REDACTED]ff33f72041e52d3fd1f47c
CVE: CVE-2023-38508
Published: 2023-08-24
Description: Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, the preview of an artifact link with a type does not respect the project, tracker and artifact level permissions. The issue occurs on the artifact view (not reproducible on the artifact modal). Users might get access to information they should not have access to. Only the title, status, assigned to and last update date fields as defined by the semantics are impacted. If those fields have strict permissions (e.g. the title is only visible to a specific user group) those permissions are still enforced. Tuleap Community Edition 14.11.99.28, Tuleap Enterprise Edition 14.10-6, and Tuleap Enterprise Edition 14.11-3 contain a fix for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285, CWE-862, CWE-862
References: https://github.com/Enalean/tuleap/commit/307c1c8044522a2dcc711062b18a3b3f9059a6c3; https://github.com/Enalean/tuleap/security/advisories/GHSA-h637-g4xp-2992; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=307c1c8044522a2dcc711062b18a3b3f9059a6c3
CVE: CVE-2023-39519
Published: 2023-08-24
Description: Cloud Explorer Lite is an open source cloud management platform. Prior to version 1.4.0, there is a risk of sensitive information leakage in the user information acquisition of CloudExplorer Lite. The vulnerability has been fixed in version 1.4.0.


CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/releases/tag/v1.4.0; https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-hh2g-77xq-x4vq; https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/releases/tag/v1.4.0
CVE: CVE-2023-39521
Published: 2023-08-24
Description: Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, content displayed in the "card fields" (visible in the kanban and PV2 apps) is not properly escaped. An agile dashboard administrator deleting a kanban with a malicious label can be forced to execute uncontrolled code. Tuleap Community Edition 14.11.99.28, Tuleap Enterprise Edition 14.10-6, and Tuleap Enterprise Edition 14.11-3 contain a fix for this issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Enalean/tuleap/commit/93d10654b1d95c5bf[PII_REDACTED]10418b01b8a8d; https://github.com/Enalean/tuleap/security/advisories/GHSA-h9xc-w7qq-vpfc; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=93d10654b1d95c5bf[PII_REDACTED]10418b01b8a8d
CVE: CVE-2023-40017
Published: 2023-08-24
Description: GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint `/proxy/?url=` does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and request information from internal hosts. A patch is available at commit a9eebae80cb362009660a1fd49e105e7cdb499b9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/GeoNode/geonode/commit/a9eebae80cb362009660a1fd49e105e7cdb499b9; https://github.com/GeoNode/geonode/security/advisories/GHSA-rmxg-6qqf-x8mr; https://github.com/GeoNode/geonode/commit/a9eebae80cb362009660a1fd49e105e7cdb499b9
CVE: CVE-2023-40022
Published: 2023-08-24
Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://github.com/rizinorg/rizin/pull/3753; https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq; https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419
CVE: CVE-2023-40030
Published: 2023-08-24
Description: Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to cross-site scripting if the report is subsequently uploaded somewhere. The vulnerability affects users relying on dependencies from git, local paths, or alternative registries. Users who solely depend on crates.io are unaffected.

Rust 1.60.0 introduced `cargo build --timings`, which produces a report of how long the different steps of the build process took. It includes lists of Cargo features for each crate. Prior to Rust 1.72, Cargo feature names were allowed to contain almost any characters (with some exceptions as used by the feature syntax), but it would produce a future incompatibility warning about them since Rust 1.49. crates.io is far more stringent about what it considers a valid feature name and has not allowed such feature names. As the feature names were included unescaped in the timings report, they could be used to inject Javascript into the page, for example with a feature name like `features = ["<img src='' onerror=alert(0)"]`. If this report were subsequently uploaded to a domain that uses credentials, the injected Javascript could access resources from the website visitor.

This issue was fixed in Rust 1.72 by turning the future incompatibility warning into an error. Users should still exercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates.io has server-side checks preventing this attack, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need to excercise care in choosing their dependencies though, as remote code execution is allowed by design there as well.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rust-lang/cargo/commit/[PII_REDACTED]f08be9a4b58ebe29dcec8f43b64b33; https://github.com/rust-lang/cargo/commit/f975722a0eac934c0722f111f107c4ea2f5c4365; https://github.com/rust-lang/cargo/pull/12291
CVE: CVE-2023-4508
Published: 2023-08-24
Description: A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS-274X file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824, CWE-824
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4508; https://github.com/gerbv/gerbv/commit/5517e22250e935dc7f86f64ad414aeae3dbcb36a; https://github.com/gerbv/gerbv/issues/191
CVE: CVE-2023-39699
Published: 2023-08-25
Description: IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://cwe.mitre.org/data/definitions/98.html; https://drive.google.com/file/d/1NkqL4ySJApyPy8B-zDC7vE-QMBQAu8OU; https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
CVE: CVE-2023-39700
Published: 2023-08-25
Description: IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cwe.mitre.org/data/definitions/79.html; https://drive.google.com/file/d/1QL_517UbTFJox4CXKQpP9fehR1yXRJ-y; https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_%28XSS%29
CVE: CVE-2023-38973
Published: 2023-08-25
Description: A stored cross-site scripting (XSS) vulnerability in the Add Tag function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anh91/uasoft-indonesia--badaso/blob/main/xss5.md; https://github.com/anh91/uasoft-indonesia--badaso/blob/main/xss5.md
CVE: CVE-2023-38974
Published: 2023-08-25
Description: A stored cross-site scripting (XSS) vulnerability in the Edit Category function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS4.md; https://github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS4.md
CVE: CVE-2023-40179
Published: 2023-08-25
Description: Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the specified email was not found in our database. It would only display the "Enter the code" form if the email is associated with a member of the site. Since version 1.3.6, the "Enter the code" form is always returned, showing the message "If the entered email is associated with an account, a code will be sent now". This change prevents potential violators from determining if our site has a user with the specified email.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-789j-chfj-58hr; https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-789j-chfj-58hr
CVE: CVE-2023-40182
Published: 2023-08-25
Description: Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes depending of whether the specified email address presents in our database or not. This has been fixed in version 1.3.7.
CVSS Score: 3.7 (LOW)
CWE: CWE-208
References: https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-9684-6j5x-ccx9; https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-9684-6j5x-ccx9
CVE: CVE-2023-40217
Published: 2023-08-25
Description: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)
CVSS Score: 5.3 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html; https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html; https://mail.python.org/archives/list/security-announce%40python.org/thread/PEPLII27KYHLF4AK3ZQGKYNCRERG4YXY/
CVE: CVE-2023-40570
Published: 2023-08-25
Description: Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords. The `/-/api` API explorer endpoint could reveal the names of both databases and tables - but not their contents - to an unauthenticated user. Datasette 1.0a4 has a fix for this issue. This will block access to the API explorer but will still allow access to the Datasette read or write JSON APIs, as those use different URL patterns within the Datasette `/database` hierarchy. This issue is patched in version 1.0a4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-213
References: https://github.com/simonw/datasette/commit/01e0558825b8f7ec17d3b691aa072daf122fcc74; https://github.com/simonw/datasette/security/advisories/GHSA-7ch3-7pp7-7cpq; https://github.com/simonw/datasette/commit/01e0558825b8f7ec17d3b691aa072daf122fcc74
CVE: CVE-2023-40577
Published: 2023-08-25
Description: Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j; https://lists.debian.org/debian-lts-announce/2023/10/msg00011.html; https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j
CVE: CVE-2023-40599
Published: 2023-08-25
Description: Regular expression Denial-of-Service (ReDoS) exists in multiple add-ons for Mailform Pro CGI 4.3.1.3 and earlier, which allows a remote unauthenticated attacker to cause a denial-of-service condition. Affected add-ons are as follows: call/call.js, prefcodeadv/search.cgi, estimate/estimate.js, search/search.js, suggest/suggest.js, and coupon/coupon.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://jvn.jp/en/jp/JVN86484824/; https://www.synck.com/blogs/news/newsroom/detail_[PII_REDACTED].html; https://jvn.jp/en/jp/JVN86484824/
CVE: CVE-2023-4520
Published: 2023-08-25
Description: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable to Arbitrary Usermeta Update via the 'save' function in versions up to, and including, 7.5.37.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, and makes it possible to update the user metas arbitrarily, but the meta value can only be a string.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/tags/7.5.36.7212/models/custom-videos.php#L341; https://plugins.trac.wordpress.org/changeset/2957322/fv-wordpress-flowplayer#file2; https://www.wordfence.com/threat-intel/vulnerabilities/id/c55ca7d4-6bc0-49c9-8ce0-50fff8775a76?source=cve