deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-23088
Published: 2023-02-03
Description: Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Barenboim/json-parser/issues/7; https://github.com/Barenboim/json-parser/issues/7
CVE: CVE-2022-31733
Published: 2023-02-03
Description: Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND unproxied ports are turned off, then an attacker could connect to an application that should be only reachable via mTLS, without presenting a client certificate.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-295, CWE-295
References: https://www.cloudfoundry.org/blog/cve-2022-31733-unsecured-application-port; https://www.cloudfoundry.org/blog/cve-2022-31733-unsecured-application-port
CVE: CVE-2022-42908
Published: 2023-02-03
Description: WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persistent across victim sessions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://enrique.wtf/CVE-2022-42908; https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-away; https://enrique.wtf/CVE-2022-42908
CVE: CVE-2022-42909
Published: 2023-02-03
Description: WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-862
References: https://enrique.wtf/CVE-2022-42909; https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-away; https://enrique.wtf/CVE-2022-42909
CVE: CVE-2023-20854
Published: 2023-02-03
Description: VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269, CWE-269
References: https://www.vmware.com/security/advisories/VMSA-2023-0003.html; https://www.vmware.com/security/advisories/VMSA-2023-0003.html
CVE: CVE-2023-23477
Published: 2023-02-03
Description: IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.  IBM X-Force ID:  245513.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/245513; https://www.ibm.com/support/pages/node/6891111; https://exchange.xforce.ibmcloud.com/vulnerabilities/245513
CVE: CVE-2023-24576
Published: 2023-02-03
Description: 


EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd) irrespective of any auth used.




CVSS Score: 7.5 (HIGH)
CWE: CWE-94, CWE-94
References: https://www.dell.com/support/kbdoc/en-us/000208258/dsa-2023-041-dell-networker-security-update-for-nsrdump-vulnerability; https://www.dell.com/support/kbdoc/en-us/000208258/dsa-2023-041-dell-networker-security-update-for-nsrdump-vulnerability
CVE: CVE-2013-10015
Published: 2023-02-03
Description: A vulnerability has been found in fanzila WebFinance 0.5 and classified as critical. This vulnerability affects unknown code of the file htdocs/admin/save_Contract_Signer_Role.php. The manipulation of the argument n/v leads to sql injection. The patch is identified as abad81af614a9ceef3f29ab22ca6bae517619e06. It is recommended to apply a patch to fix this issue. VDB-220054 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/fanzila/WebFinance/commit/abad81af614a9ceef3f29ab22ca6bae517619e06; https://vuldb.com/?ctiid.220054; https://vuldb.com/?id.220054
CVE: CVE-2013-10016
Published: 2023-02-03
Description: A vulnerability was found in fanzila WebFinance 0.5 and classified as critical. This issue affects some unknown processing of the file htdocs/admin/save_taxes.php. The manipulation of the argument id leads to sql injection. The patch is named 306f170ca2a8203ae3d8f51fb219ba9e05b945e1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-220055.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/fanzila/WebFinance/commit/306f170ca2a8203ae3d8f51fb219ba9e05b945e1; https://vuldb.com/?ctiid.220055; https://vuldb.com/?id.220055
CVE: CVE-2023-22474
Published: 2023-02-03
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`. 
CVSS Score: 8.7 (HIGH)
CWE: CWE-290
References: https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8; https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x; https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8
CVE: CVE-2023-23925
Published: 2023-02-03
Description: Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS). This issue has been patched in version 3.1.4. As a workaround, avoid using Strategy settings that use REGEX in conjunction with EXIST and NOT_EXIST operations.

CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-1333, CWE-1333
References: https://github.com/switcherapi/switcher-client-master/releases/tag/v3.1.4; https://github.com/switcherapi/switcher-client-master/security/advisories/GHSA-wqxw-8h5g-hq56; https://github.com/switcherapi/switcher-client-master/releases/tag/v3.1.4
CVE: CVE-2023-23933
Published: 2023-02-03
Description: OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can read aggregated numerical data (e.g. averages, sums) of fields that are otherwise restricted to them. This issue only affects authenticated users who were previously granted read access to the indexes containing the restricted fields. This issue has been patched in versions 1.3.8 and 2.6.0. There are no known workarounds for this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://github.com/opensearch-project/anomaly-detection/security/advisories/GHSA-47qw-jwpx-pp4c; https://github.com/opensearch-project/anomaly-detection/security/advisories/GHSA-47qw-jwpx-pp4c
CVE: CVE-2023-23937
Published: 2023-02-03
Description: Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce.
The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain. This issue has been patched in version 10.5.16. 
CVSS Score: 8.2 (HIGH)
CWE: CWE-434
References: https://github.com/pimcore/pimcore/commit/75a448ef8ac74424cf4e723afeb6d05f9eed872f; https://github.com/pimcore/pimcore/security/advisories/GHSA-8xv4-jj4h-qww6; https://github.com/pimcore/pimcore/commit/75a448ef8ac74424cf4e723afeb6d05f9eed872f
CVE: CVE-2023-23940
Published: 2023-02-03
Description: OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.

CVSS Score: 6.4 (MEDIUM)
CWE: CWE-345, CWE-347, CWE-347
References: https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299; https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9j4-mcp4; https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299
CVE: CVE-2022-45491
Published: 2023-02-03
Description: Buffer overflow vulnerability in function json_parse_value in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows attackers to code arbitrary code and gain escalated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-122, CWE-787
References: https://github.com/hyrathon/trophies/security/advisories/GHSA-55fm-gm4m-3v3j; https://github.com/sheredom/json.h/issues/94; https://github.com/hyrathon/trophies/security/advisories/GHSA-55fm-gm4m-3v3j
CVE: CVE-2022-45492
Published: 2023-02-03
Description: Buffer overflow vulnerability in function json_parse_number in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows attackers to code arbitrary code and gain escalated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/hyrathon/trophies/security/advisories/GHSA-r9wh-hxqh-3xq7; https://github.com/sheredom/json.h/issues/95; https://github.com/hyrathon/trophies/security/advisories/GHSA-r9wh-hxqh-3xq7
CVE: CVE-2022-45493
Published: 2023-02-03
Description: Buffer overflow vulnerability in function json_parse_key in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows attackers to code arbitrary code and gain escalated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/hyrathon/trophies/security/advisories/GHSA-r2mm-2f4c-6243; https://github.com/hyrathon/trophies/security/advisories/GHSA-r2mm-2f4c-6243
CVE: CVE-2022-45496
Published: 2023-02-03
Description: Buffer overflow vulnerability in function json_parse_string in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows attackers to code arbitrary code and gain escalated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/hyrathon/trophies/security/advisories/GHSA-29hf-wrjw-2f28; https://github.com/sheredom/json.h/issues/92; https://github.com/hyrathon/trophies/security/advisories/GHSA-29hf-wrjw-2f28
CVE: CVE-2022-45588
Published: 2023-02-03
Description: All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 and Talend Cloud Engine for Design are not impacted. This XXE vulnerability could only be exploited by someone with the appropriate rights to edit pipelines on the Talend platform. It could not be triggered remotely or by other user input.
CVSS Score: 7.8 (HIGH)
CWE: CWE-611, CWE-611
References: http://talend.com; https://www.talend.com/security/incident-response/#CVE-2022-45588; http://talend.com
CVE: CVE-2022-47070
Published: 2023-02-03
Description: NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the server twice. In the second package, the server will return the correct password information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/Sylon001/NVS-365-Camera/tree/master/NVS365%20Network%20Video%20Server%20Password%20Information%20Unauthorized%20Access%20Vulnerability; https://github.com/Sylon001/NVS365/tree/main/NVS-365-V01%E6%91%84%E5%83%8F%E5%A4%B4%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E5%AF%86%E7%A0%81; https://github.com/Sylon001/NVS-365-Camera/tree/master/NVS365%20Network%20Video%20Server%20Password%20Information%20Unauthorized%20Access%20Vulnerability
CVE: CVE-2022-47762
Published: 2023-02-03
Description: In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/flipped-aurora/gin-vue-admin/issues/1309; https://github.com/flipped-aurora/gin-vue-admin/issues/1309
CVE: CVE-2022-48165
Published: 2023-02-03
Description: An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
CVSS Score: 7.5 (HIGH)
References: https://docs.google.com/document/d/1HD4GKumkZpa6FNHuf0QQSKFvoYhCfwXpbyWiJdx1VtE/edit?usp=sharing; https://github.com/strik3r0x1/Vulns/blob/main/WAVLINK_WL-WN530H4.md; https://docs.google.com/document/d/1HD4GKumkZpa6FNHuf0QQSKFvoYhCfwXpbyWiJdx1VtE/edit?usp=sharing
CVE: CVE-2023-0663
Published: 2023-02-03
Description: A vulnerability was found in Calendar Event Management System 2.3.0. It has been rated as critical. This issue affects some unknown processing of the component Login Page. The manipulation of the argument name/pwd leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-220175.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?ctiid.220175; https://vuldb.com/?id.220175; https://www.youtube.com/watch?v=UsSZU6EWB1E
CVE: CVE-2023-23932
Published: 2023-02-03
Description: OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input. This issue has been patched in version 3.23.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-248
References: https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1; https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4; https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1
CVE: CVE-2023-23941
Published: 2023-02-03
Description: SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://github.com/shopware/SwagPayPal/commit/57db5f4a57ef0a1646b509b415de9f03bf441b08; https://github.com/shopware/SwagPayPal/security/advisories/GHSA-vxpm-8hcp-qh27; https://github.com/shopware/SwagPayPal/commit/57db5f4a57ef0a1646b509b415de9f03bf441b08
CVE: CVE-2023-24029
Published: 2023-02-03
Description: In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user modification workflows.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863, CWE-863
References: https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-January-2023?popup=true; https://www.progress.com/ws_ftp; https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-January-2023?popup=true
CVE: CVE-2023-25125
Published: 2023-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2023. Notes: none.
CVE: CVE-2023-25126
Published: 2023-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2023. Notes: none.
CVE: CVE-2023-25127
Published: 2023-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2023. Notes: none.
CVE: CVE-2023-25128
Published: 2023-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2023. Notes: none.
CVE: CVE-2023-25129
Published: 2023-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2023. Notes: none.
CVE: CVE-2023-25130
Published: 2023-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2023. Notes: none.
CVE: CVE-2022-23498
Published: 2023-02-03
Description: Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.

CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8; https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-24894
Published: 2023-02-03
Description: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-285
References: https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb; https://github.com/symfony/symfony/security/advisories/GHSA-h7vf-5wrv-9fhv; https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html
CVE: CVE-2022-24895
Published: 2023-02-03
Description: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-384, CWE-613
References: https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2022-24895.yaml; https://github.com/symfony/security-bundle/commit/076fd2088ada33d760758d98ff07ddedbf567946; https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4
CVE: CVE-2023-22746
Published: 2023-02-03
Description: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the `.env` file, that key was shared across different CKAN instances, making it easy to forge authentication requests. Users overriding the default secret key in their own `.env` file are not affected by this issue. Note that the legacy images (ckan/ckan) located in the main CKAN repo are not affected by this issue. The affected images are ckan/ckan-docker, (ckan/ckan-base images), okfn/docker-ckan (openknowledge/ckan-base and openknowledge/ckan-dev images)
keitaroinc/docker-ckan (keitaro/ckan images).

CVSS Score: 8.6 (HIGH)
CWE: CWE-330, CWE-344
References: https://github.com/ckan/ckan/commit/44af0f0a148fcc0e0fbcf02fe69b7db13459a84b; https://github.com/ckan/ckan/commit/4c22c135fa486afa13855d1cdb9765eaf418d2aa; https://github.com/ckan/ckan/security/advisories/GHSA-pr8j-v4c8-h62x
CVE: CVE-2023-23082
Published: 2023-02-03
Description: A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-787
References: https://github.com/xbmc/xbmc/commit/8c2aafb6d[PII_REDACTED]e037c923aaf83f9ff41e1; https://github.com/xbmc/xbmc/issues/22377; https://github.com/xbmc/xbmc/pull/22380
CVE: CVE-2023-23615
Published: 2023-02-03
Description: Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a workaround, disable embeddable comments by deleting all embeddable hosts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/discourse/discourse/security/advisories/GHSA-7mf3-5v84-wxq8; https://github.com/discourse/discourse/security/advisories/GHSA-7mf3-5v84-wxq8
CVE: CVE-2013-10017
Published: 2023-02-04
Description: A vulnerability was found in fanzila WebFinance 0.5. It has been classified as critical. Affected is an unknown function of the file htdocs/admin/save_roles.php. The manipulation of the argument id leads to sql injection. The name of the patch is 6cfeb2f6b35c1b3a7320add07cd0493e4f752af3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-220056.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/fanzila/WebFinance/commit/6cfeb2f6b35c1b3a7320add07cd0493e4f752af3; https://vuldb.com/?ctiid.220056; https://vuldb.com/?id.220056