deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-41529
Published: 2025-08-07
Description: Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and lname parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/celbahraoui/f600264c0e82ca2828cf9b8748d04007; https://github.com/kishan0725/Hospital-Management-System
CVE: CVE-2023-41530
Published: 2025-08-07
Description: Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/8b9bd172bc637ab791005db0b239ae89; https://github.com/kishan0725/Hospital-Management-System
CVE: CVE-2023-41531
Published: 2025-08-07
Description: Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3.php via the username1 and password2 parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/f3e2c9d9d015aa455949e3d3c4fdade6; https://github.com/kishan0725/Hospital-Management-System
CVE: CVE-2023-41532
Published: 2025-08-07
Description: Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter in doctorsearch.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/9972727c6770cd63386ebbe07a9c1454; https://github.com/kishan0725/Hospital-Management-System
CVE: CVE-2025-51629
Published: 2025-08-07
Description: A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Temp parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://agenzia.com; http://eccobook.com; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2025-51629%20%7C%20Eccobook.md
CVE: CVE-2025-50675
Published: 2025-08-07
Description: GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory. The directory is accessible with full read, write, and execute permissions for all users, allowing unprivileged users to manipulate files within the directory, including executable files like GPMAW3.exe, Fragment.exe, and the uninstaller GPsetup64_17028.exe. An attacker with user-level access can exploit this misconfiguration by replacing or modifying the uninstaller (GPsetup64_17028.exe) with a malicious version. While the application itself runs in the user's context, the uninstaller is typically executed with administrative privileges when an administrator attempts to uninstall the software. By exploiting this flaw, an attacker could gain administrative privileges and execute arbitrary code in the context of the admin, resulting in privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/LukeSec/CVE-2025-50675-GPMAW-Permissions/tree/main; https://www.gpmaw.com/html/downloads.html; https://github.com/LukeSec/CVE-2025-50675-GPMAW-Permissions/tree/main
CVE: CVE-2025-50692
Published: 2025-08-07
Description: FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/cyb3res3c/ceacf7d560d2c8cd5ffd158abf0bfba9; https://reference1.example.com/index.php/admin/template_file/editFile.html; https://gist.github.com/cyb3res3c/ceacf7d560d2c8cd5ffd158abf0bfba9
CVE: CVE-2025-51533
Published: 2025-08-07
Description: An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.sec4you-pentest.com/schwachstelle/sage-dpw-vorhersehbare-url-ids-ermoeglichen-unautorisierten-zugriff-auf-interne-formulare/; https://www.sec4you-pentest.com/schwachstellen; https://www.sec4you-pentest.com/schwachstelle/sage-dpw-vorhersehbare-url-ids-ermoeglichen-unautorisierten-zugriff-auf-interne-formulare/
CVE: CVE-2025-55077
Published: 2025-08-07
Description: Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01.
CVSS Score: 7.4 (HIGH)
CWE: CWE-250, CWE-668, CWE-863
References: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-219-01.json; https://www.cve.org/CVERecord?id=CVE-2025-55077
CVE: CVE-2025-7195
Published: 2025-08-07
Description: Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. 

In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-276
References: https://access.redhat.com/errata/RHEA-2025:23406; https://access.redhat.com/errata/RHEA-2025:23478; https://access.redhat.com/errata/RHEA-2026:0129
CVE: CVE-2025-8697
Published: 2025-08-07
Description: A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical. This issue affects the function StdioServerParameters of the component MCPSessionManager/MCPTool/MCPToolkit. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/bayuncao-bit/vul-37; https://github.com/bayuncao-bit/vul-37#proof-of-concept; https://vuldb.com/?ctiid.319127
CVE: CVE-2025-47183
Published: 2025-08-07
Description: In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md; https://gstreamer.freedesktop.org/security/; https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
CVE: CVE-2025-47219
Published: 2025-08-07
Description: In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md; https://gstreamer.freedesktop.org/security/
CVE: CVE-2025-47806
Published: 2025-08-07
Description: In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-121
References: https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md; https://gstreamer.freedesktop.org/security/
CVE: CVE-2025-47807
Published: 2025-08-07
Description: In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md; https://gstreamer.freedesktop.org/security/; https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
CVE: CVE-2025-47808
Published: 2025-08-07
Description: In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a crash.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-476
References: https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md; https://gstreamer.freedesktop.org/security/
CVE: CVE-2025-48709
Published: 2025-08-07
Description: BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.
CVSS Score: 3.8 (LOW)
CWE: CWE-214, CWE-532, CWE-522
References: https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/
CVE: CVE-2025-26513
Published: 2025-08-07
Description: The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local user to escalate their privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2025-45765
Published: 2025-08-07
Description: ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforced by this library. Currently more recent versions of OpenSSL are enforcing some key sizes and those restrictions apply to the users of this gem also."
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-326
References: https://gist.github.com/ZupeiNie/c621253068ce5b[PII_REDACTED]4879e8f9; https://github.com/jwt/ruby-jwt/issues/668
CVE: CVE-2025-53767
Published: 2025-08-07
Description: Azure OpenAI Elevation of Privilege Vulnerability
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53767
CVE: CVE-2025-53774
Published: 2025-08-07
Description: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53774
CVE: CVE-2025-53787
Published: 2025-08-07
Description: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
CVSS Score: 8.2 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53787
CVE: CVE-2025-53792
Published: 2025-08-07
Description: Azure Portal Elevation of Privilege Vulnerability
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53792
CVE: CVE-2025-8698
Published: 2025-08-07
Description: A vulnerability was found in Open5GS up to 2.7.5. It has been classified as problematic. Affected is the function amf_nsmf_pdusession_handle_release_sm_context of the file src/amf/nsmf-handler.c of the component AMF Service. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The name of the patch is 66bc558e417e70ae216ec155e4e81c14ae0ecf30. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-617
References: https://github.com/open5gs/open5gs/commit/66bc558e417e70ae216ec155e4e81c14ae0ecf30; https://github.com/open5gs/open5gs/issues/4012; https://github.com/user-attachments/files/21356631/amf_nsmf_pdusession_handle_release_sm_context.zip
CVE: CVE-2025-8701
Published: 2025-08-07
Description: A vulnerability was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /OL_OprationLog/GetPageList. The manipulation of the argument optUser leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/si12/xxx/issues/1; https://vuldb.com/?ctiid.319130; https://vuldb.com/?id.319130
CVE: CVE-2025-54787
Published: 2025-08-07
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named by an ID (e.g. attachments). An unauthenticated attacker could download internal files when he discovers a valid file-ID.
Valid IDs could be brute-forced, but this is quite time-consuming as the file-IDs are usually UUIDs. This issue is fixed in version 7.14.7.
CVSS Score: 3.7 (LOW)
CWE: CWE-285
References: https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7; https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-8r72-224q-g9fv
CVE: CVE-2025-30404
Published: 2025-08-07
Description: An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/pytorch/executorch/commit/d158236b1dc84539c1b16843bc74054c9dcba006; https://www.facebook.com/security/advisories/cve-2025-30404
CVE: CVE-2025-30405
Published: 2025-08-07
Description: An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 0830af8207240df8d7f35b984cdf8bc35d74fa73.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/pytorch/executorch/commit/0830af8207240df8d7f35b984cdf8bc35d74fa73; https://www.facebook.com/security/advisories/cve-2025-30405
CVE: CVE-2025-54949
Published: 2025-08-07
Description: A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://github.com/pytorch/executorch/commit/ede82493dae6d2d43f8c424e7be4721abe5242be; https://www.facebook.com/security/advisories/cve-2025-54949
CVE: CVE-2025-54950
Published: 2025-08-07
Description: An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/pytorch/executorch/commit/b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005; https://www.facebook.com/security/advisories/cve-2025-54950
CVE: CVE-2025-54951
Published: 2025-08-07
Description: A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://github.com/pytorch/executorch/commit/cea9b23aa8ff78aff92829a466da97461cc7930c; https://www.facebook.com/security/advisories/cve-2025-54951
CVE: CVE-2025-54368
Published: 2025-08-08
Description: uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with legitimate contents on some package installers, and malicious contents on others due to multiple local file entries. An attacker could  also contrive a "stacked" ZIP input with multiple internal ZIPs, which would be handled differently by different package installers. The attacker could choose which installer to target in both scenarios. This issue is fixed in version 0.8.6. To work around this issue, users may choose to set UV_INSECURE_NO_ZIP_VALIDATION=1 to revert to the previous behavior.
CWE: CWE-20, CWE-436
References: https://astral.sh/blog/uv-security-advisory-cve-2025-54368; https://blog.pypi.org/posts/2025-08-07-wheel-archive-confusion-attacks; https://github.com/astral-sh/uv/commit/7f1eaf48c193e045ca2c62c[PII_REDACTED]c55505f
CVE: CVE-2025-54952
Published: 2025-08-08
Description: An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 8f062d3f661e20bb19b24b767b9a9a46e8359f2b.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-680
References: https://github.com/pytorch/executorch/commit/8f062d3f661e20bb19b24b767b9a9a46e8359f2b; https://www.facebook.com/security/advisories/cve-2025-54952
CVE: CVE-2025-8702
Published: 2025-08-08
Description: A vulnerability classified as critical has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This affects an unknown part of the file /CommonSolution/GetVariableByOneIDNew of the component Historical Data Query Module. The manipulation of the argument ObjectID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/si12/xxx/issues/2; https://vuldb.com/?ctiid.319131; https://vuldb.com/?id.319131
CVE: CVE-2025-54793
Published: 2025-08-08
Description: Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk of phishing and other social engineering attacks. This affects sites that use on-demand rendering (SSR) with the Node or Cloudflare adapters. It does not affect static sites, or sites deployed to Netlify or Vercel. This issue is fixed in version 5.12.8. To work around this issue at the network level, block outgoing redirect responses with a Location header value that starts with `//`.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/withastro/astro/commit/0567fb7b50c0c452be387dd7c7264b96bedab48f; https://github.com/withastro/astro/security/advisories/GHSA-cq8c-xv66-36gw
CVE: CVE-2025-54886
Published: 2025-08-08
Description: skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.get_model does not contain any logic to prevent arbitrary code execution. The Card.get_model function supports both joblib and skops for model loading. When loading .skops models, it uses skops' secure loading with trusted type validation, raising errors for untrusted types unless explicitly allowed. However, when non-.zip file formats are provided, the function silently falls back to joblib without warning. Unlike skops, joblib allows arbitrary code execution during loading, bypassing security measures and potentially enabling malicious code execution. This issue is fixed in version 0.13.0.
CVSS Score: 8.4 (HIGH)
CWE: CWE-502
References: https://github.com/skops-dev/skops/commit/29d61ea8a92f2bde6830e8f32cc72a1a87211cda; https://github.com/skops-dev/skops/security/advisories/GHSA-378x-6p4f-8jgm
CVE: CVE-2025-54887
Published: 2025-08-08
Description: jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk because JWEs can be modified to decrypt to an arbitrary value, decrypted by observing parsing differences and the GCM internal GHASH key can be recovered. Users are affected by this vulnerability even if they do not use an AES-GCM encryption algorithm for their JWEs. As the GHASH key may have been leaked, users must rotate the encryption keys after upgrading. This issue is fixed in version 1.1.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-354
References: https://github.com/jwt/ruby-jwe/commit/1e719d79ba3d7aadaa39a2f08c25df077a0f9ff1; https://github.com/jwt/ruby-jwe/security/advisories/GHSA-c7p4-hx26-pr73
CVE: CVE-2025-8703
Published: 2025-08-08
Description: A vulnerability classified as critical was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This vulnerability affects unknown code of the file /WEAS_HomePage/GetAreaTrendChartData of the component Environmental Real-Time Data Module. The manipulation of the argument energyId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/si12/xxx/issues/3; https://vuldb.com/?ctiid.319132; https://vuldb.com/?id.319132
CVE: CVE-2025-8704
Published: 2025-08-08
Description: A vulnerability, which was classified as critical, has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This issue affects some unknown processing of the file /WEAS_AlarmResult/GetAlarmResultProcessList of the component Analysis Conclusion Query Module. The manipulation of the argument resultId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/si12/xxx/issues/4; https://vuldb.com/?ctiid.319133; https://vuldb.com/?id.319133
CVE: CVE-2025-8705
Published: 2025-08-08
Description: A vulnerability, which was classified as critical, was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. Affected is an unknown function of the file /WEAS_HomePage/GetTargetConfig of the component Energy Overview Module. The manipulation of the argument BP_ProID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/si12/xxx/issues/5; https://vuldb.com/?ctiid.319134; https://vuldb.com/?id.319134
CVE: CVE-2025-8706
Published: 2025-08-08
Description: A vulnerability has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /CommonSolution/CreateFunctionLog of the component Energy Overview Module. The manipulation of the argument MM_MenID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/si12/xxx/issues/6; https://vuldb.com/?ctiid.319135; https://vuldb.com/?id.319135