deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1457
Published: 2025-04-19
Description: The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Wrapper Link, Countdown and Gallery widgets in all versions up to, and including, 5.10.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-countdown.min.js; https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-wrapper-link.min.js; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3272946%40bdthemes-element-pack-lite&new=3272946%40bdthemes-element-pack-lite&sfp_email=&sfph_mail=#file1095
CVE: CVE-2025-3275
Published: 2025-04-19
Description: The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider widget in all versions up to, and including, 2.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/assets/js/tf-flexslider.js; https://plugins.trac.wordpress.org/changeset/3268183/themesflat-addons-for-elementor/tags/2.2.2/assets/js/tf-flexslider.js; https://www.wordfence.com/threat-intel/vulnerabilities/id/4ec73a61-9ae2-4e6f-b1fa-2d61f27d6809?source=cve
CVE: CVE-2025-3103
Published: 2025-04-19
Description: The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to insufficient file path validation in the 'history.php' file in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server, which may contain sensitive information including database credentials. The vulnerability was partially patched in version 2.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-73
References: https://codecanyon.net/item/clever-html5-radio-player-with-history-shoutcast-and-icecast-elementor-widget-addon/26708087#item-description__updates-release-log; https://www.wordfence.com/threat-intel/vulnerabilities/id/0733261f-a2e1-4bd1-a57d-fdaaa8c904db?source=cve
CVE: CVE-2024-13926
Published: 2025-04-19
Description: The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number of tags, thereby exploiting a catastrophic backtracking issue in the regular expression processing to cause a DoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://wpscan.com/vulnerability/b5f0092e-7cd5-412f-a8ea-7bd4a8bf86d2/
CVE: CVE-2025-2111
Published: 2025-04-19
Description: The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wp-headers-and-footers/trunk/lib/wpb-sdk/views/wpb-debug.php#L63; https://plugins.trac.wordpress.org/browser/wp-headers-and-footers/trunk/lib/wpb-sdk/views/wpb-debug.php#L69; https://plugins.trac.wordpress.org/changeset/3276361/
CVE: CVE-2025-3809
Published: 2025-04-19
Description: The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the auto-refresh debug log in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2025-32613 is a duplicate of this CVE.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3267252%40debug-log-manager&new=3267252%40debug-log-manager&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc3210d-224e-4ed2-ada7-dc17deb17584?source=cve
CVE: CVE-2025-3797
Published: 2025-04-19
Description: A vulnerability classified as critical was found in SeaCMS up to 13.3. This vulnerability affects unknown code of the file /admin_topic.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/FSRM1/CVE/blob/main/seacms_sql2.md; https://vuldb.com/?ctiid.305650; https://vuldb.com/?id.305650
CVE: CVE-2021-4455
Published: 2025-04-19
Description: The Wordpress Plugin Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/50533; https://www.wordfence.com/threat-intel/vulnerabilities/id/1de9183c-95b9-4500-85e2-08dcee956360?source=cve
CVE: CVE-2025-3404
Published: 2025-04-19
Description: The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all versions up to, and including, 3.3.12. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.12/src/Admin/Menu/Packages.php#L45; https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.12/src/Admin/Menu/Packages.php#L56; https://www.wordfence.com/threat-intel/vulnerabilities/id/21f8f5be-b513-4040-af39-c1a61d7e313f?source=cve
CVE: CVE-2025-3661
Published: 2025-04-19
Description: The SB Chart block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/sb-chart-block/trunk/sb-chart-block.php#L104; https://plugins.trac.wordpress.org/changeset/3276462/; https://wordpress.org/plugins/sb-chart-block/#developers
CVE: CVE-2025-3798
Published: 2025-04-19
Description: A vulnerability, which was classified as critical, has been found in WCMS 11. This issue affects the function sub of the file app/admin/AdvadminController.php of the component Advertisement Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/IceFoxH/VULN/issues/16; https://vuldb.com/?ctiid.305651; https://vuldb.com/?id.305651
CVE: CVE-2025-3799
Published: 2025-04-19
Description: A vulnerability, which was classified as critical, was found in WCMS 11. Affected is an unknown function of the file app/controllers/AnonymousController.php. The manipulation of the argument email/username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/IceFoxH/VULN/issues/15; https://vuldb.com/?ctiid.305652; https://vuldb.com/?id.305652
CVE: CVE-2025-3800
Published: 2025-04-19
Description: A vulnerability has been found in WCMS 11 and classified as critical. Affected by this vulnerability is an unknown functionality of the file app/controllers/AnonymousController.php. The manipulation of the argument mobile_phone leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/IceFoxH/VULN/issues/14; https://vuldb.com/?ctiid.305653; https://vuldb.com/?id.305653
CVE: CVE-2025-3801
Published: 2025-04-19
Description: A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content/About System/Footer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/yaowenxiao721/Poc/blob/main/One-API/One-API-poc.md; https://vuldb.com/?ctiid.305655; https://vuldb.com/?id.305655
CVE: CVE-2025-3802
Published: 2025-04-19
Description: A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). It has been declared as critical. This vulnerability affects the function cgiPingSet of the file /bin/httpd. The manipulation of the argument pingIP leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/02Tn/vul/issues/2; https://vuldb.com/?ctiid.305656; https://vuldb.com/?id.305656
CVE: CVE-2025-3803
Published: 2025-04-19
Description: A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). It has been rated as critical. This issue affects the function cgiSysScheduleRebootSet of the file /bin/httpd. The manipulation of the argument rebootDate leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/02Tn/vul/issues/3; https://vuldb.com/?ctiid.305657; https://vuldb.com/?id.305657
CVE: CVE-2025-3804
Published: 2025-04-19
Description: A vulnerability classified as critical has been found in thautwarm vscode-diana 0.0.1. Affected is an unknown function of the file Gen.py of the component Jinja2 Template Handler. The manipulation leads to injection. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74, CWE-707
References: https://github.com/thautwarm/vscode-diana/issues/1; https://github.com/thautwarm/vscode-diana/issues/1#issue[PII_REDACTED]; https://vuldb.com/?ctiid.305658
CVE: CVE-2025-3805
Published: 2025-04-19
Description: A vulnerability classified as critical was found in sarrionandia tournatrack up to 4c13a23f43da5317eea4614870a7a8510fc540ec. Affected by this vulnerability is an unknown functionality of the file check_id.py of the component Jinja2 Template Handler. The manipulation of the argument ID leads to injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74, CWE-707
References: https://github.com/sarrionandia/tournatrack/issues/86; https://github.com/sarrionandia/tournatrack/issues/86#issue[PII_REDACTED]; https://vuldb.com/?ctiid.305659
CVE: CVE-2025-3806
Published: 2025-04-19
Description: A vulnerability, which was classified as problematic, has been found in dazhouda lecms up to 3.0.3. Affected by this issue is some unknown functionality of the file /admin of the component Edit Profile Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms.md; https://vuldb.com/?ctiid.305660; https://vuldb.com/?id.305660
CVE: CVE-2025-3807
Published: 2025-04-19
Description: A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0. This affects the function Upload of the file src/main/java/com/my/bbs/controller/common/UploadController.java of the component Endpoint. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/caigo8/CVE-md/blob/main/My-bbs/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md; https://vuldb.com/?ctiid.305661; https://vuldb.com/?id.305661
CVE: CVE-2025-3808
Published: 2025-04-19
Description: A vulnerability has been found in zhenfeng13 My-BBS 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/caigo8/CVE-md/blob/main/My-bbs/CSRF.md; https://vuldb.com/?ctiid.305662; https://vuldb.com/?id.305662
CVE: CVE-2025-3816
Published: 2025-04-19
Description: A vulnerability classified as critical was found in westboy CicadasCMS 2.0. This vulnerability affects unknown code of the file /system/schedule/save of the component Scheduled Task Handler. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/chujianxin0101/vuln/issues/3; https://vuldb.com/?ctiid.305722; https://vuldb.com/?id.305722
CVE: CVE-2025-3817
Published: 2025-04-19
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /oews/classes/Master.php?f=delete_stock. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/88hsb88/cve/blob/main/sql.md; https://vuldb.com/?ctiid.305723; https://vuldb.com/?id.305723
CVE: CVE-2025-43917
Published: 2025-04-19
Description: In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product. Specifically, an administrator can insert a new file at the pathname of the removed pritunl-service file. This file then is executed by a LaunchDaemon as root.
CVSS Score: 8.2 (HIGH)
CWE: CWE-863
References: https://forum.pritunl.com/t/pritunl-client-v1-3-4220-57/3183
CVE: CVE-2025-3818
Published: 2025-04-19
Description: A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://noppgwz8if.feishu.cn/docx/TxjpddUpTokyBwxibSgcTRr7nUf; https://vuldb.com/?ctiid.305724; https://vuldb.com/?id.305724
CVE: CVE-2025-3819
Published: 2025-04-19
Description: A vulnerability has been found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wcndy13/cve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.305725
CVE: CVE-2022-47111
Published: 2025-04-19
Description: 7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.
CVSS Score: 2.5 (LOW)
CWE: CWE-754
References: https://github.com/boofish/semantic-bugs/
CVE: CVE-2022-47112
Published: 2025-04-19
Description: 7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected.
CVSS Score: 2.5 (LOW)
CWE: CWE-754
References: https://github.com/boofish/semantic-bugs/
CVE: CVE-2025-3820
Published: 2025-04-19
Description: A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644) and classified as critical. Affected by this issue is the function cgiSysUplinkCheckSet of the file /bin/httpd. The manipulation of the argument hostIp1/hostIp2 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/02Tn/vul/issues/4; https://vuldb.com/?ctiid.305726; https://vuldb.com/?id.305726
CVE: CVE-2023-26819
Published: 2025-04-19
Description: cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]4567]}.
CVSS Score: 2.9 (LOW)
CWE: CWE-440
References: https://github.com/boofish/json_bugs/tree/main/cjson; https://lists.debian.org/debian-lts-announce/2025/06/msg00014.html
CVE: CVE-2023-30421
Published: 2025-04-19
Description: mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as[PII_REDACTED]900e[PII_REDACTED]55114.
CVSS Score: 2.9 (LOW)
CWE: CWE-407
References: https://github.com/boofish/json_bugs/blob/main/mjson; https://github.com/cesanta/mjson/releases
CVE: CVE-2025-43918
Published: 2025-04-19
Description: SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued for the domain name of a requester's email address, even when the requester does not otherwise establish administrative control of that domain.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-348
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1961406; https://news.ycombinator.com/item?id=43738485
CVE: CVE-2025-43919
Published: 2025-04-20
Description: GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-24, CWE-22
References: https://code.launchpad.net/~mailman-coders/mailman/2.1; https://github.com/0NYX-MY7H/CVE-2025-43919; https://github.com/cpanel/mailman2-python3
CVE: CVE-2025-43920
Published: 2025-04-20
Description: GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://code.launchpad.net/~mailman-coders/mailman/2.1; https://github.com/0NYX-MY7H/CVE-2025-43920; https://github.com/cpanel/mailman2-python3
CVE: CVE-2025-43921
Published: 2025-04-20
Description: GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://code.launchpad.net/~mailman-coders/mailman/2.1; https://github.com/0NYX-MY7H/CVE-2025-43921; https://github.com/cpanel/mailman2-python3
CVE: CVE-2025-43928
Published: 2025-04-20
Description: In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-24, CWE-22
References: https://cfp.eh22.easterhegg.eu/eh22/talk/9UDXSE/; https://mint-secure.de/path-traversal-vulnerability-in-surveillance-software/
CVE: CVE-2025-43929
Published: 2025-04-20
Description: open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://ghostwriter.kde.org/documentation/#links; https://github.com/0xBenCantCode/CVE-2025-43929; https://github.com/kovidgoyal/kitty/commit/ce5cfdd9caf44c538af800a07162e1f49bd53c35
CVE: CVE-2025-3821
Published: 2025-04-20
Description: A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file add-admin.php. The manipulation of the argument txtpassword/txtfullname/txtemail leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md; https://vuldb.com/?ctiid.305728; https://vuldb.com/?id.305728
CVE: CVE-2025-3822
Published: 2025-04-20
Description: A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file changepassword.php. The manipulation of the argument txtconfirm_password/txtnew_password/txtold_password leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md; https://vuldb.com/?ctiid.305729; https://vuldb.com/?id.305729