deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-47229
Published: 2025-05-03
Description: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and application exit) via crafted input data, such as data that triggers a call from src/data/dictionary.c code into src/data/variable.c code.
CVSS Score: 2.9 (LOW)
CWE: CWE-617
References: https://savannah.gnu.org/bugs/?67049
CVE: CVE-2025-4168
Published: 2025-05-03
Description: The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-80
References: https://plugins.trac.wordpress.org/browser/subpage-view/trunk/inc/class-subpage-list-shortcode.php#L25; https://www.wordfence.com/threat-intel/vulnerabilities/id/aca48ddf-4256-4a55-bff5[PII_REDACTED]dd?source=cve
CVE: CVE-2025-4170
Published: 2025-05-03
Description: The Xavin&#039;s Review Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/xavins-review-ratings/trunk/xavins-review-ratings.php#L293; https://www.wordfence.com/threat-intel/vulnerabilities/id/6c057a98-4a8d-408a-b6a4-3c322bfa0cdf?source=cve
CVE: CVE-2025-4172
Published: 2025-05-03
Description: The VerticalResponse Newsletter Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'verticalresponse' shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/vertical-response-newsletter-widget/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0565cdf1-55fe-4676-8529-8c79be5e8b01?source=cve
CVE: CVE-2025-4188
Published: 2025-05-03
Description: The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'reorder-simple-image-text-slider-setting' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/abundatrade-plugin/tags/1.8.02/abundatrade_pugin.php; https://wordpress.org/plugins/advanced-reorder-image-text-slider/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb8a509-9acd-457c-8cb9-725f615148ce?source=cve
CVE: CVE-2025-4198
Published: 2025-05-03
Description: The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the 'alink-tap' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/alink-tap/trunk/admin/views/admin.php; https://wordpress.org/plugins/alink-tap/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c856e06d-34f7-42e9-a72c-3d4e9207e07e?source=cve
CVE: CVE-2025-4199
Published: 2025-05-03
Description: The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or incorrect nonce validation on the 'abundatrade' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/abundatrade-plugin/tags/1.8.02/abundatrade_pugin.php; https://wordpress.org/plugins/abundatrade-plugin/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef828667-f241-4c5c-92a8-0a4f366e190f?source=cve
CVE: CVE-2025-4222
Published: 2025-05-03
Description: The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessible location. This makes it possible for unauthenticated attackers to extract sensitive data from database backup files. An index file is present, so a brute force attack would need to be successful in order to compromise any data.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-admin.php#L247; https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-backup.php#L76; https://www.guyshavit.com/post/cve-2025-4222
CVE: CVE-2025-3815
Published: 2025-05-03
Description: The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.12.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/surveyjs/surveyjs-wordpress; https://github.com/surveyjs/surveyjs-wordpress/commit/6c332319c82c32d7148f77ed7ee20a9c6a5dc179; https://plugins.trac.wordpress.org/browser/surveyjs/trunk/initializer.php#L165
CVE: CVE-2024-58135
Published: 2025-05-03
Description: Mojolicious versions from 7.28 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default

When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-338, CWE-338
References: https://github.com/hashcat/hashcat/pull/4090; https://github.com/mojolicious/mojo/pull/2200; https://lists.debian.org/debian-perl/2025/05/msg00016.html
CVE: CVE-2025-4226
Published: 2025-05-03
Description: A vulnerability classified as critical has been found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. This affects an unknown part of the file /add-computer.php. The manipulation of the argument compname/comploc leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/diyuzhishen/mycve/issues/2; https://vuldb.com/?ctiid.307323; https://vuldb.com/?id.307323
CVE: CVE-2025-37799
Published: 2025-05-03
Description: In the Linux kernel, the following vulnerability has been resolved:

vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp

vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that
is, packet sizes between 128 - 3k bytes).

We noticed MTU-related connectivity issues with Cilium's service load-
balancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP
backend service where the XDP LB was doing IPIP encap led to overly large
packet sizes but only for *some* of the packets (e.g. HTTP GET request)
while others (e.g. the prior TCP 3WHS) looked completely fine on the wire.

In fact, the pcap recording on the backend node actually revealed that the
node with the XDP LB was leaking uninitialized kernel data onto the wire
for the affected packets, for example, while the packets should have been
152 bytes their actual size was 1482 bytes, so the remainder after 152 bytes
was padded with whatever other data was in that page at the time (e.g. we
saw user/payload data from prior processed packets).

We only noticed this through an MTU issue, e.g. when the XDP LB node and
the backend node both had the same MTU (e.g. 1500) then the curl request
got dropped on the backend node's NIC given the packet was too large even
though the IPIP-encapped packet normally would never even come close to
the MTU limit. Lowering the MTU on the XDP LB (e.g. 1480) allowed to let
the curl request succeed (which also indicates that the kernel ignored the
padding, and thus the issue wasn't very user-visible).

Commit e127ce7699c1 ("vmxnet3: Fix missing reserved tailroom") was too eager
to also switch xdp_prepare_buff() from rcd->len to rbi->len. It really needs
to stick to rcd->len which is the actual packet length from the descriptor.
The latter we also feed into vmxnet3_process_xdp_small(), by the way, and
it indicates the correct length needed to initialize the xdp->{data,data_end}
parts. For e127ce7699c1 ("vmxnet3: Fix missing reserved tailroom") the
relevant part was adapting xdp_init_buff() to address the warning given the
xdp_data_hard_end() depends on xdp->frame_sz. With that fixed, traffic on
the wire looks good again.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/33e131a10459d16f181c8184d3f17f1c318c7002; https://git.kernel.org/stable/c/4c2227656d9003f4d77afc76f34dd81b95e4c2c4; https://git.kernel.org/stable/c/c4312c4d244aa58e811ff0297e013124d115e793
CVE: CVE-2025-4236
Published: 2025-05-03
Description: A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component MDIR Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-900150983cd24fb0d6963f7d28e17f72.txt; https://vuldb.com/?ctiid.307327; https://vuldb.com/?id.307327
CVE: CVE-2025-4237
Published: 2025-05-03
Description: A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-c4ca4238a0b923820dcc509a6f75849b.txt; https://vuldb.com/?ctiid.307328; https://vuldb.com/?id.307328
CVE: CVE-2024-41753
Published: 2025-05-03
Description: IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7232197
CVE: CVE-2024-58134
Published: 2025-05-03
Description: Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.

These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
CVSS Score: 8.1 (HIGH)
CWE: CWE-321, CWE-331
References: https://docs.mojolicious.org/Mojolicious/Guides/FAQ#What-does-Your-secret-passphrase-needs-to-be-changed-mean; https://github.com/hashcat/hashcat/pull/4090; https://github.com/mojolicious/mojo/pull/1791
CVE: CVE-2025-1495
Published: 2025-05-03
Description: IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-306
References: https://www.ibm.com/support/pages/node/7232434
CVE: CVE-2025-4238
Published: 2025-05-03
Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component MGET Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-a87ff679a2f3e71d9181a67b7542122c.txt; https://vuldb.com/?ctiid.307329; https://vuldb.com/?id.307329
CVE: CVE-2025-4239
Published: 2025-05-03
Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component TYPE Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-1679091c5a880faf6fb5e6087eb1b2dc.txt; https://vuldb.com/?ctiid.307330; https://vuldb.com/?id.307330
CVE: CVE-2025-4240
Published: 2025-05-03
Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. This issue affects some unknown processing of the component LCD Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-3c2b72a81c4f4fbe75903a2c9280d78fce69420fbc77e78ea6e73b34b735e70a.txt; https://vuldb.com/?ctiid.307331; https://vuldb.com/?id.307331
CVE: CVE-2025-4241
Published: 2025-05-03
Description: A vulnerability classified as critical has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/bluechips-zhao/myCVE/issues/6; https://phpgurukul.com/; https://vuldb.com/?ctiid.307332
CVE: CVE-2025-1838
Published: 2025-05-03
Description: IBM Cloud Pak for Business Automation

 24.0.0 and 24.0.1 through 24.0.1 IF001 

Authoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-602
References: https://www.ibm.com/support/pages/node/7232429
CVE: CVE-2025-4242
Published: 2025-05-03
Description: A vulnerability classified as critical was found in PHPGurukul Online Birth Certificate System 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/between-dates-report.php. The manipulation of the argument fromdate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/bluechips-zhao/myCVE/issues/8; https://phpgurukul.com/; https://vuldb.com/?ctiid.307333
CVE: CVE-2025-4243
Published: 2025-05-03
Description: A vulnerability, which was classified as critical, has been found in code-projects Online Bus Reservation System 1.0. Affected by this issue is some unknown functionality of the file /print.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/zzZxby/Vulnerability-Exploration/blob/main/Online%20Bus%20Reservation%20System/Online%20Bus%20Reservation%20System1.md; https://vuldb.com/?ctiid.307334
CVE: CVE-2025-4244
Published: 2025-05-03
Description: A vulnerability, which was classified as critical, was found in code-projects Online Bus Reservation System 1.0. This affects an unknown part of the file /seatlocation.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/zzZxby/Vulnerability-Exploration/blob/main/Online%20Bus%20Reservation%20System/Online%20Bus%20Reservation%20System2.md; https://vuldb.com/?ctiid.307335
CVE: CVE-2025-47241
Published: 2025-05-03
Description: In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-647
References: https://github.com/browser-use/browser-use/pull/1561; https://github.com/browser-use/browser-use/releases/tag/0.1.45; https://github.com/browser-use/browser-use/security/advisories/GHSA-x39x-9qw5-ghrf
CVE: CVE-2025-47244
Published: 2025-05-03
Description: Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.
CVSS Score: 7.3 (HIGH)
CWE: CWE-288
References: https://docs.inedo.com/docs/proget/installation/installation-guide; https://forums.inedo.com; https://my.inedo.com/downloads/installers?product=ProGet
CVE: CVE-2025-47245
Published: 2025-05-04
Description: In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.
CVSS Score: 8.1 (HIGH)
CWE: CWE-472
References: https://github.com/bluewave-labs/Checkmate/commit/d4a60723f490502b3fe6f7f780a85d29bf5d1385; https://github.com/bluewave-labs/Checkmate/pull/2160; https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-7x3q-g6gq-f4mm
CVE: CVE-2025-4247
Published: 2025-05-04
Description: A vulnerability, which was classified as critical, was found in SourceCodester Simple To-Do List System 1.0. Affected is an unknown function of the file /delete_task.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zonesec0/findcve/issues/8; https://vuldb.com/?ctiid.307344; https://vuldb.com/?id.307344
CVE: CVE-2025-4248
Published: 2025-05-04
Description: A vulnerability has been found in SourceCodester Simple To-Do List System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /complete_task.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zonesec0/findcve/issues/9; https://vuldb.com/?ctiid.307345; https://vuldb.com/?id.307345
CVE: CVE-2025-4249
Published: 2025-05-04
Description: A vulnerability was found in PHPGurukul e-Diary Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /manage-categories.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/MichaelZhuang521/curly-memory/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.307346
CVE: CVE-2025-4250
Published: 2025-05-04
Description: A vulnerability was found in code-projects Nero Social Networking Site 1.0. It has been classified as critical. This affects an unknown part of the file /index.php. The manipulation of the argument fname/lname/login/password2/cpassword/address/cnumber/email/gender/propic/month leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzZxby/Vulnerability-Exploration/blob/main/Nero%20Social%20Networking%20Site/Nero_Social_Networking_Site.md; https://vuldb.com/?ctiid.307347
CVE: CVE-2025-4251
Published: 2025-05-04
Description: A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. This issue affects some unknown processing of the component RMDIR Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-a10ec24750e57a60258d3b176f899b0246b544785f86e8a1cb58c8b275a2fdee.txt; https://vuldb.com/?ctiid.307355; https://vuldb.com/?id.307355
CVE: CVE-2025-4252
Published: 2025-05-04
Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component APPEND Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-65b1721b02d84e0c79b6cd3c2473d3ed9c441087d702bd3a76b82fc2ae04388b.txt; https://vuldb.com/?ctiid.307356; https://vuldb.com/?id.307356
CVE: CVE-2025-4253
Published: 2025-05-04
Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component HASH Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-6a5b279ed51b35667909c1b56d4d85d71d41bc6e73d4fbbf3de2b1f59ebd6d08.txt; https://vuldb.com/?ctiid.307357; https://vuldb.com/?id.307357
CVE: CVE-2025-4254
Published: 2025-05-05
Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component LIST Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-e4fd[PII_REDACTED]01fef4607c9a2641c3db234bb5a057a22952bfb70e70b4c279.txt; https://vuldb.com/?ctiid.307358; https://vuldb.com/?id.307358