deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-34451
Published: 2025-12-18
Description: rofl0r/proxychains-ng versions up to and including 4.17 and prior to commit cc005b7 contain a stack-based buffer overflow vulnerability in the function proxy_from_string() located in src/libproxychains.c. When parsing crafted proxy configuration entries containing overly long username or password fields, the application may write beyond the bounds of fixed-size stack buffers, leading to memory corruption or crashes. This vulnerability may allow denial of service and, under certain conditions, could be leveraged for further exploitation depending on the execution environment and applied mitigations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/httpsgithu/proxychains-ng/commit/cc005b7; https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-008-proxychains-ng-stack-buffer-overflow-proxy_from_string.md; https://github.com/rofl0r/proxychains-ng/issues/606
CVE: CVE-2025-34452
Published: 2025-12-18
Description: Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabilities in that allow an authenticated attacker to write arbitrary files to the server filesystem. The issue exists in the subtitle download functionality, where user-controlled parameters are used to fetch remote content and construct file paths without proper validation. By supplying a crafted subtitle download URL and a path traversal sequence in the file name, an attacker can write files to arbitrary locations on the server, potentially leading to remote code execution.
CWE: CWE-22, CWE-918
References: https://chocapikk.com/posts/2025/streama-path-traversal-ssrf/; https://github.com/streamaserver/streama/commit/b7c8767; https://www.vulncheck.com/advisories/streama-subtitle-download-path-traversal-and-ssrf-leading-to-arbitrary-file-write
CVE: CVE-2025-64663
Published: 2025-12-18
Description: Custom Question Answering Elevation of Privilege Vulnerability
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-918
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64663
CVE: CVE-2025-64676
Published: 2025-12-18
Description: '.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network.
CVSS Score: 7.2 (HIGH)
CWE: CWE-35, CWE-94
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64676
CVE: CVE-2025-64677
Published: 2025-12-18
Description: Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64677
CVE: CVE-2025-65037
Published: 2025-12-18
Description: Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-65037
CVE: CVE-2025-65041
Published: 2025-12-18
Description: Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-285
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-65041
CVE: CVE-2025-65046
Published: 2025-12-18
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 3.1 (LOW)
CWE: CWE-451, CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-65046
CVE: CVE-2025-68381
Published: 2025-12-18
Description: Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid fragment sequence number.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-30/384178
CVE: CVE-2025-68382
Published: 2025-12-18
Description: Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a denial-of-service (DoS) through a reliable process crash when handling truncated XDR-encoded RPC messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-31/384179
CVE: CVE-2025-68383
Published: 2025-12-18
Description: Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1284
References: https://discuss.elastic.co/t/filebeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-32/384180
CVE: CVE-2025-68384
Published: 2025-12-18
Description: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://discuss.elastic.co/t/elasticsearch-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-33/384181
CVE: CVE-2025-68388
Published: 2025-12-18
Description: Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to a degradation in Packetbeat.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-29/384177
CVE: CVE-2025-68279
Published: 2025-12-18
Description: Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Version 5.15.1 fixes the issue.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22, CWE-59, CWE-200
References: https://github.com/WeblateOrg/weblate/pull/17331; https://github.com/WeblateOrg/weblate/pull/17356; https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1
CVE: CVE-2025-68385
Published: 2025-12-18
Description: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://discuss.elastic.co/t/kibana-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-34/384182
CVE: CVE-2025-68386
Published: 2025-12-18
Description: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-38/384186
CVE: CVE-2025-68387
Published: 2025-12-18
Description: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://discuss.elastic.co/t/kibana-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-35/384183
CVE: CVE-2025-68389
Published: 2025-12-18
Description: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://discuss.elastic.co/t/kibana-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-36/384184
CVE: CVE-2025-68390
Published: 2025-12-18
Description: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-770
References: https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-37/384185
CVE: CVE-2025-68398
Published: 2025-12-18
Description: Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-22, CWE-434
References: https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4; https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd[PII_REDACTED]5ea7; https://github.com/WeblateOrg/weblate/pull/17330
CVE: CVE-2025-68422
Published: 2025-12-18
Description: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-39/384187
CVE: CVE-2025-14897
Published: 2025-12-19
Description: A vulnerability was identified in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of the file /admin/useragentdelete.php of the component Administrator Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli-useragentdelete.md; https://vuldb.com/?ctiid.337422
CVE: CVE-2025-14898
Published: 2025-12-19
Description: A security flaw has been discovered in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /admin/userbuilderdelete.php of the component Administrator Endpoint. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli-userbuilderdelete.php.md; https://vuldb.com/?ctiid.337423
CVE: CVE-2025-64675
Published: 2025-12-19
Description: Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64675
CVE: CVE-2025-11774
Published: 2025-12-19
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referred to as "keypad function") of Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 CFR3 and prior, and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute arbitrary executable files (EXE) when a legitimate user uses the keypad function by tampering with the configuration file for the function. This could allow the attacker to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a denial-of-service (DoS) condition on the system, through the execution of the EXE.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/vu/JVNVU97729686/; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-018_en.pdf
CVE: CVE-2025-14733
Published: 2025-12-19
Description: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733
CVE: CVE-2025-14899
Published: 2025-12-19
Description: A weakness has been identified in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /admin/stateadd.php of the component Administrator Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/stateadd.php-sqli.md; https://vuldb.com/?ctiid.337424
CVE: CVE-2025-14900
Published: 2025-12-19
Description: A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /admin/userdelete.php of the component Administrator Endpoint. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/userdelete-sqli.md; https://vuldb.com/?ctiid.337425
CVE: CVE-2025-14908
Published: 2025-12-19
Description: A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java of the component Multi-Tenant Management Module. Performing manipulation of the argument ID results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The patch is named e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2/67795493bdc579e489d3ab12e52a1793c4f8a0ee. It is recommended to apply a patch to fix this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/jeecgboot/JeecgBoot/commit/e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2; https://github.com/jeecgboot/JeecgBoot/issues/9196; https://vuldb.com/?ctiid.337432
CVE: CVE-2025-13941
Published: 2025-12-19
Description: A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions are assigned to resources used by the update service. A local attacker with low privileges could modify or replace these resources, which are later executed by the service, resulting in execution of arbitrary code with SYSTEM privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-14909
Published: 2025-12-19
Description: A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Executing manipulation can lead to manage user sessions. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This patch is called b686f9fbd1917edffe5922c6362c817a9361cfbd. Applying a patch is advised to resolve this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1018
References: https://github.com/jeecgboot/JeecgBoot/commit/b686f9fbd1917edffe5922c6362c817a9361cfbd; https://github.com/jeecgboot/JeecgBoot/issues/9195; https://github.com/jeecgboot/JeecgBoot/issues/9195#issue[PII_REDACTED]
CVE: CVE-2025-14910
Published: 2025-12-19
Description: A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon Service. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Edimax confirms this issue: "This product is no longer available in the market and has been discontinued for five years. Consequently, Edimax no longer provides technical support, firmware updates, or security patches for this specific model. However, to ensure the safety of our remaining active users, we acknowledge this report and will take the following mitigation actions: (A) We will issue an official security advisory on our support website. (B) We will strongly advise users to disable the FTP service on this device to mitigate the reported risk, by which the product will still work for common use. (C) We will recommend users upgrade to newer, supported models." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://tzh00203.notion.site/EDIMAX-BR-6208AC-V2_1-02-Path-Traversal-Vulnerability-in-FTPd-2c4b5c52018a80fb8812f7d510abf558?source=copy_link; https://vuldb.com/?ctiid.337435; https://vuldb.com/?id.337435
CVE: CVE-2025-52692
Published: 2025-12-19
Description: Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-118/
CVE: CVE-2025-67842
Published: 2025-12-19
Description: The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-829
References: https://gist.github.com/hackermondev/5e2cdc32849405fff6b46957747a2d28; https://heartbreak.ing; https://kibty.town/blog/mintlify/
CVE: CVE-2025-67843
Published: 2025-12-19
Description: A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file.
CVSS Score: 8.3 (HIGH)
CWE: CWE-1336
References: https://kibty.town/blog/mintlify/; https://news.ycombinator.com/item?id=46317098; https://www.mintlify.com/blog/working-with-security-researchers-november-2025
CVE: CVE-2025-67844
Published: 2025-12-19
Description: The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub App Installation ID associated with the user's organization.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-425
References: https://kibty.town/blog/mintlify/; https://news.ycombinator.com/item?id=46317098; https://www.mintlify.com/blog/working-with-security-researchers-november-2025
CVE: CVE-2025-67845
Published: 2025-12-19
Description: A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing path traversal sequences.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-24
References: https://heartbreak.ing/; https://kibty.town/blog/mintlify/; https://news.ycombinator.com/item?id=46317098
CVE: CVE-2025-67846
Published: 2025-12-19
Description: The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgrade attacks via predictable deployment identifiers on the Vercel preview domain. An attacker can identify the URL structure of a previous deployment that contains unpatched vulnerabilities. By browsing directly to the specific git-ref or deployment-id subdomain, the attacker can force the application to load the vulnerable version.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-472
References: https://kibty.town/blog/mintlify/; https://news.ycombinator.com/item?id=46317098; https://www.mintlify.com/blog/working-with-security-researchers-november-2025
CVE: CVE-2025-14939
Published: 2025-12-19
Description: A vulnerability was found in code-projects Online Appointment Booking System 1.0. Impacted is an unknown function of the file /admin/deletemanager.php. The manipulation of the argument managername results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wegitlab/cve/issues/1; https://vuldb.com/?ctiid.337519
CVE: CVE-2025-14940
Published: 2025-12-19
Description: A vulnerability was determined in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /admin/delete_user.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/gx922/CVE/issues/1; https://vuldb.com/?ctiid.337520
CVE: CVE-2025-14546
Published: 2025-12-19
Description: Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/tomasvotava/fastapi-sso/commit/6117d1a5ad498ba57d671e8a059ebe20db5abe02; https://github.com/tomasvotava/fastapi-sso/issues/266; https://security.snyk.io/vuln/SNYK-PYTHON-FASTAPISSO-14386403
CVE: CVE-2025-13307
Published: 2025-12-19
Description: The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be displayed under user-controlled conditions that Editors and Administrators can set (edit_pages capability). The conditions are then executed as part of an eval statement executed on every site page. This leads to remote code execution.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/710de342-6fb9-47bd-a40b-7b74fc3c181b/