deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-53775
Published: 2025-12-10
Description: Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change user passwords by exploiting weak session management controls. Attackers can reuse IP-bound session identifiers to issue unauthorized requests to the userManager API and modify user credentials without proper authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-384
References: https://www.dbbroadcast.com; https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/; https://www.exploit-db.com/exploits/51456
CVE: CVE-2023-53776
Published: 2025-12-10
Description: Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to exploit weak session management by reusing IP-bound session identifiers. Attackers can issue unauthorized requests to the device management API by leveraging the session binding mechanism to perform critical operations on the transmitter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://www.dbbroadcast.com; https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/; https://www.exploit-db.com/exploits/51459
CVE: CVE-2024-58279
Published: 2025-12-10
Description: appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading a crafted PHP file to the site's uploads directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/apprain/apprain/archive/refs/tags/v4.0.5.zip; https://www.apprain.org; https://www.exploit-db.com/exploits/52041
CVE: CVE-2024-58280
Published: 2025-12-10
Description: CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensions_userfiles and upload a shell script to the media directory to execute arbitrary code on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-403
References: https://www.cmsimple.org; https://www.cmsimple.org/downloads_cmsimple50/CMSimple_5-15.zip; https://www.exploit-db.com/exploits/52040
CVE: CVE-2024-58281
Published: 2025-12-10
Description: Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload process by crafting a PHP shell with a command execution form to gain system access through the uploaded file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://git.dotclear.org/explore/repos; https://github.com/dotclear/dotclear/archive/refs/heads/master.zip; https://www.exploit-db.com/exploits/52037
CVE: CVE-2024-58282
Published: 2025-12-10
Description: Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload mechanism by creating a PHP shell with a command execution form that enables arbitrary system command execution on the web server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://docs.s9y.org/; https://www.exploit-db.com/exploits/52036; https://www.s9y.org/latest
CVE: CVE-2024-58283
Published: 2025-12-10
Description: WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/WBCE/WBCE_CMS/archive/refs/tags/1.6.2.zip; https://wbce-cms.org/; https://www.exploit-db.com/exploits/52039
CVE: CVE-2024-58284
Published: 2025-12-10
Description: PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/PopojiCMS/PopojiCMS; https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip; https://www.exploit-db.com/exploits/52022
CVE: CVE-2024-58285
Published: 2025-12-10
Description: Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/chyrp/; https://github.com/chyrp/chyrp/archive/refs/tags/v2.5.2.zip; https://www.exploit-db.com/exploits/52013
CVE: CVE-2025-65290
Published: 2025-12-10
Description: Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attackers to intercept firmware update traffic and potentially serve modified firmware files.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/OTA-Certificate-Validation-Bypass.md
CVE: CVE-2025-65291
Published: 2025-12-10
Description: Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/CoAP-Certificate-Validation-Bypass.md
CVE: CVE-2025-65292
Published: 2025-12-10
Description: Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges through malicious domain names.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/DNS-Command-Injection.md
CVE: CVE-2025-65293
Published: 2025-12-10
Description: Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR codes during device setup and factory reset.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-77
References: https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/QR-Command-Injection.md
CVE: CVE-2025-65294
Published: 2025-12-10
Description: Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/QR-Command-Injection.md; https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/Undocumented-Remote-Execution.md
CVE: CVE-2025-65295
Published: 2025-12-10
Description: Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.
CVSS Score: 8.1 (HIGH)
CWE: CWE-326, CWE-347, CWE-457
References: https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/OTA-Firmware-Insecurity.md
CVE: CVE-2025-65296
Published: 2025-12-10
Description: NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-service attacks through malformed JSON inputs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/JSON-NULL-Dereference.md
CVE: CVE-2025-65297
Published: 2025-12-10
Description: Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-5
References: https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/Unauthorized-Data-Upload.md
CVE: CVE-2025-66033
Published: 2025-12-10
Description: Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401
References: https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f; https://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638
CVE: CVE-2025-66472
Published: 2025-12-10
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through  17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the "No" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd[PII_REDACTED]d1cfbd280f2; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w; https://jira.xwiki.org/browse/XWIKI-23244
CVE: CVE-2025-66473
Published: 2025-12-10
Description: XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the /rest/wikis/xwiki/spaces resource returns all spaces on the wiki by default, which are basically all pages. This issue is fixed in versions 17.4.4 and 16.10.11.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/xwiki/xwiki-platform/commit/e3c47745195fb445b054537be86f5c01ee69558b; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cc84-q3v3-mhgf; https://jira.xwiki.org/browse/XWIKI-23355
CVE: CVE-2025-66474
Published: 2025-12-10
Description: XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which enable remote code execution as well as unrestricted read and write access to all wiki contents. This issue is fixed in versions 16.10.10, 17.4.3 and 17.6.0-rc-1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11; https://github.com/xwiki/xwiki-rendering/commit/9b71a2ee035815cfc29cebbfe81dbdd98f941d49; https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-9xc6-c2rm-f27p
CVE: CVE-2025-66628
Published: 2025-12-10
Description: ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8; https://github.com/dlemstra/Magick.NET/commit/2dfa08e15cfd11016a[PII_REDACTED]7b14f9048b1c
CVE: CVE-2025-12731
Published: 2025-12-10
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-13923
Published: 2025-12-10
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-67490
Published: 2025-12-10
Description: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://github.com/auth0/nextjs-auth0/commit/26cc8a7c60f4b[PII_REDACTED]6f991a25bd6bbf0b; https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-wcgj-f865-c7j7
CVE: CVE-2025-67505
Published: 2025-12-10
Description: Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
CVSS Score: 8.4 (HIGH)
CWE: CWE-362
References: https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243; https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff
CVE: CVE-2025-67509
Published: 2025-12-10
Description: Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass.  MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via prompt injection through a public agent endpoint) may write arbitrary files to the DB server if the MySQL/MariaDB account has the FILE privilege and server configuration permits writes to a useful location (e.g., a web-accessible directory). This issue is fixed in version 2.8.12.
CVSS Score: 8.2 (HIGH)
CWE: CWE-94
References: https://github.com/neuron-core/neuron-ai/commit/72735d0ea133266cf2f5d5d195d41e9dd865289a; https://github.com/neuron-core/neuron-ai/releases/tag/2.8.12; https://github.com/neuron-core/neuron-ai/security/advisories/GHSA-j8g6-5gqc-mq36
CVE: CVE-2025-67510
Published: 2025-12-10
Description: Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-250, CWE-284
References: https://github.com/neuron-core/neuron-ai/commit/44bab85d92bf162898ee48d0bcef6ba0d29b59c9; https://github.com/neuron-core/neuron-ai/releases/tag/2.8.12; https://github.com/neuron-core/neuron-ai/security/advisories/GHSA-898v-775g-777c
CVE: CVE-2025-67513
Published: 2025-12-10
Description: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.
CWE: CWE-521
References: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-426v-c5p7-cp29
CVE: CVE-2025-67511
Published: 2025-12-11
Description: Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is  available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77
References: https://github.com/aliasrobotics/cai/commit/09ccb6e0baccf56c40e6cb429c698750843a999c; https://github.com/aliasrobotics/cai/security/advisories/GHSA-4c65-9gqf-4w8h; https://www.hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself
CVE: CVE-2025-67512
Published: 2025-12-11
Description: Rejected reason: The vulnerability is dependency-based.
CVE: CVE-2025-67514
Published: 2025-12-11
Description: Rejected reason: Vulnerability is dependency-based.
CVE: CVE-2025-67644
Published: 2025-12-11
Description: LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and below are vulnerable to SQL injection through the checkpoint implementation. Checkpoint allows attackers to manipulate SQL queries through metadata filter keys, affecting applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations. The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation. This issue is fixed in version 3.0.1.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/langchain-ai/langgraph/commit/297242913f8ad2143ee3e2f72e67db0911d48e2a; https://github.com/langchain-ai/langgraph/security/advisories/GHSA-9rwj-6rc7-p77c
CVE: CVE-2025-67646
Published: 2025-12-11
Description: TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the extension enabled, would trigger unintended authenticated actions through the victim's browser. Due to the lack of token validation, an attacker can delete or track progress against tables. This issue is patched in version 1.2.1 of the extension.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://github.com/Telepedia/TableProgressTracking/commit/e2aa8c4b3bb78989c6fe39070a95a26d22b91c94; https://github.com/Telepedia/TableProgressTracking/security/advisories/GHSA-j24f-hw6w-cq78
CVE: CVE-2025-67648
Published: 2025-12-11
Description: Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58; https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2
CVE: CVE-2025-67713
Published: 2025-12-11
Description: Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/miniflux/v2/commit/76df99f3a3db234cf6b312be5e771485213d03c7; https://github.com/miniflux/v2/security/advisories/GHSA-wqv2-4wpg-8hc9
CVE: CVE-2025-67716
Published: 2025-12-11
Description: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-184
References: https://github.com/auth0/nextjs-auth0/commit/35eb321de3345ccf23e8c0d6f66c9f2f2f57d26c; https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-mr6f-h57v-rpj5
CVE: CVE-2025-67717
Published: 2025-12-11
Description: ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be sensitive in certain contexts. This issue is fixed in versions 3.4.5 and 4.7.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://github.com/zitadel/zitadel/commit/826039c6208fe71df57b3a94c982b5ac5b0af12c; https://github.com/zitadel/zitadel/security/advisories/GHSA-f4cf-9rvr-2rcx
CVE: CVE-2025-67718
Published: 2025-12-11
Description: Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized request could retrieve data from endpoints that should be protected. This issue is fixed in versions 3.5.7 and 4.4.3.
CWE: CWE-178, CWE-200
References: https://github.com/formio/formio/commit/1836bdd9f55f5888ff397c257b2108c09d3de478; https://github.com/formio/formio/security/advisories/GHSA-m654-769v-qjv7