deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-67719
Published: 2025-12-11
Description: Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 do not have password validation. During the transition from v4 to v5 an error was introduced into validation code which causes the validation of the previous password not to run as expected. This makes it possible for a logged in user to change their password in the back office without knowing the previous password. For example, if a user logs into their account and walks away without locking their workstation, an attacker could access the unattended session and change the password, therefore locking the legitimate user out. This issue is fixed in version 5.0.4.
CWE: CWE-620
References: https://developers.ibexa.co/security-advisories/ibexa-sa-2025-005-password-change-and-xss-vulnerabilities-in-back-office; https://github.com/ibexa/user/commit/9d485bf385e6401c9f7ee80287d8ccd00f73dcf4; https://github.com/ibexa/user/security/advisories/GHSA-x93p-w2ch-fg67
CVE: CVE-2025-67720
Published: 2025-12-11
Description: Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the download_media method before using them in file path construction. When downloading media, if the user does not specify a custom filename (which is the common/default usage), the method falls back to using the file_name attribute from the media object. The attribute originates from Telegram's DocumentAttributeFilename and is controlled by the message sender. This issue is fixed in version 2.3.69.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/Mayuri-Chan/pyrofork/commit/2f2d515575cc9c360bd74340a61a1d2b1e1f1f95; https://github.com/Mayuri-Chan/pyrofork/security/advisories/GHSA-6h2f-wjhf-4wjx
CVE: CVE-2025-11467
Published: 2025-12-11
Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 5.1.1 via the feedzy_lazy_load function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.1.0/includes/abstract/feedzy-rss-feeds-admin-abstract.php#L551; https://www.wordfence.com/threat-intel/vulnerabilities/id/5754dce7-6b47-4490-a04a-7eabfded0720?source=cve
CVE: CVE-2025-13764
Published: 2025-12-11
Description: The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://themeforest.net/item/boxcar-automotive-car-dealer-wordpress-theme/49741717; https://www.wordfence.com/threat-intel/vulnerabilities/id/f4893d9c-e039-43df-80b9-dbe42374caed?source=cve
CVE: CVE-2025-14485
Published: 2025-12-11
Description: A weakness has been identified in EFM ipTIME A3004T 14.19.0. This vulnerability affects the function show_debug_screen of the file /sess-bin/timepro.cgi of the component Administrator Password Handler. This manipulation of the argument aaksjdkfj with the input !@dnjsrureljrm*& causes command injection. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://pan.baidu.com/s/12VsWYY-bf2-Kfufbs2dlXw?pwd=drt; https://vuldb.com/?ctiid.335768; https://vuldb.com/?id.335768
CVE: CVE-2025-10163
Published: 2025-12-11
Description: The List category posts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘starting_with’ parameter of the catlist shortcode in all versions up to, and including, 0.91.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/list-category-posts/tags/0.91.0/include/lcp-parameters.php#L240; https://www.wordfence.com/threat-intel/vulnerabilities/id/21708205-dd43-4b22-9151-bc6f882422cb?source=cve
CVE: CVE-2025-12562
Published: 2025-12-11
Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/; https://gitlab.com/gitlab-org/gitlab/-/issues/579152; https://hackerone.com/reports/3360710
CVE: CVE-2025-12716
Published: 2025-12-11
Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with malicious content.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/; https://gitlab.com/gitlab-org/gitlab/-/issues/579548; https://hackerone.com/reports/3405832
CVE: CVE-2025-13978
Published: 2025-12-11
Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to discover the names of private projects they do not have access through API requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/; https://gitlab.com/gitlab-org/gitlab/-/issues/566960; https://gitlab.com/gitlab-org/gitlab/-/work_items/566960
CVE: CVE-2025-14157
Published: 2025-12-11
Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 6.3 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a Denial of Service condition by sending crafted API calls with large content parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/; https://gitlab.com/gitlab-org/gitlab/-/issues/574324
CVE: CVE-2025-9436
Published: 2025-12-11
Description: The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-reviews-plugin-for-google/tags/13.0/trustindex-plugin.class.php#L803; https://www.wordfence.com/threat-intel/vulnerabilities/id/94974552-1c52-417b-9b4e-c30fd13a8ad4?source=cve
CVE: CVE-2025-11247
Published: 2025-12-11
Description: GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/; https://gitlab.com/gitlab-org/gitlab/-/issues/573766; https://hackerone.com/reports/3307422
CVE: CVE-2025-11984
Published: 2025-12-11
Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to bypass WebAuthn two-factor authentication by manipulating the session state under certain conditions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-288
References: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/; https://gitlab.com/gitlab-org/gitlab/-/issues/577847; https://hackerone.com/reports/3322714
CVE: CVE-2025-4097
Published: 2025-12-11
Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a denial of service condition by uploading specially crafted images.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/; https://gitlab.com/gitlab-org/gitlab/-/issues/538192
CVE: CVE-2025-8405
Published: 2025-12-11
Description: GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.
CVSS Score: 7.7 (HIGH)
CWE: CWE-116
References: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/; https://gitlab.com/gitlab-org/gitlab/-/issues/558214; https://hackerone.com/reports/3270940
CVE: CVE-2025-14512
Published: 2025-12-11
Description: A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://access.redhat.com/errata/RHSA-2026:15953; https://access.redhat.com/errata/RHSA-2026:15971; https://access.redhat.com/errata/RHSA-2026:7461
CVE: CVE-2025-67738
Published: 2025-12-11
Description: squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
CVSS Score: 8.5 (HIGH)
CWE: CWE-78
References: https://github.com/webmin/webmin/commit/1a52bf4d72f9da6d79250c66e51f41c6f5b880ee; https://github.com/webmin/webmin/compare/2.520...2.600; https://webmin.com/security/#privilige-escalation-using-squid-module-cve-2025-67738
CVE: CVE-2025-12029
Published: 2025-12-11
Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI."
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/; https://gitlab.com/gitlab-org/gitlab/-/issues/577975; https://hackerone.com/reports/3317485
CVE: CVE-2025-12734
Published: 2025-12-11
Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to, under certain conditions, render content in dialogs to other users by injecting malicious HTML content into merge request titles.
CVSS Score: 3.5 (LOW)
CWE: CWE-116
References: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/; https://gitlab.com/gitlab-org/gitlab/-/issues/579573; https://hackerone.com/reports/3379381
CVE: CVE-2025-64701
Published: 2025-12-11
Description: QND Premium/Advance/Standard Ver.11.0.9i and prior contains a privilege escalation vulnerability, which may allow a user who can log in to a Windows system with the affected product to gain administrator privileges. As a result, sensitive information may be accessed or altered, and arbitrary actions may be performed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-268
References: https://jvn.jp/jp/JVN40102375/; https://www.qualitysoft.com/product/qnd_vulnerabilities_2025/
CVE: CVE-2025-12687
Published: 2025-12-11
Description: A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to cause a denial of service (application crash) via a crafted command, resulting in service termination.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1005/
CVE: CVE-2025-14514
Published: 2025-12-11
Description: A flaw has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/add_distributor.php. This manipulation of the argument txtDistributorAddress causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ProgramShowMaker/CVE/issues/4; https://github.com/ProgramShowMaker/CVE/issues/5; https://vuldb.com/?ctiid.335852
CVE: CVE-2025-44016
Published: 2025-12-11
Description: A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to bypass file integrity validation via a crafted request. By providing a valid hash for a malicious file, an attacker can cause the service to incorrectly validate and process the file as trusted, enabling arbitrary code execution under the Nomad Branch service context.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1005/
CVE: CVE-2025-46266
Published: 2025-12-11
Description: A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to coerce the service into transmitting data to an arbitrary internal IP address, potentially leaking sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1005/
CVE: CVE-2025-64986
Published: 2025-12-11
Description: A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction prior V21. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-77
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/
CVE: CVE-2025-64987
Published: 2025-12-11
Description: A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-77
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/
CVE: CVE-2025-64988
Published: 2025-12-11
Description: A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-77
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/
CVE: CVE-2025-64989
Published: 2025-12-11
Description: A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/
CVE: CVE-2025-64990
Published: 2025-12-11
Description: A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/
CVE: CVE-2025-64991
Published: 2025-12-11
Description: A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior V15. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-77
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/
CVE: CVE-2025-64992
Published: 2025-12-11
Description: A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-77
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/
CVE: CVE-2025-64993
Published: 2025-12-11
Description: A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-77
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/
CVE: CVE-2025-64994
Published: 2025-12-11
Description: A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. The improper handling of executable search paths could allow local attackers with write access to a PATH directory on a device to escalate privileges and execute arbitrary code as SYSTEM.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/
CVE: CVE-2025-64995
Published: 2025-12-11
Description: A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction prior V3.4. Improper protection of the execution path on the local device allows attackers, with local access to the device during execution, to hijack the process and execute arbitrary code with SYSTEM privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/
CVE: CVE-2025-13003
Published: 2025-12-11
Description: Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc. AxOnboard allows Exploitation of Trusted Identifiers.This issue affects AxOnboard: from 3.2.0 before 3.3.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0446
CVE: CVE-2025-14515
Published: 2025-12-11
Description: A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_unit.php. Such manipulation of the argument txtunitDetails leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/falling-snow1/vuldb/issues/3; https://vuldb.com/?ctiid.335853; https://vuldb.com/?id.335853
CVE: CVE-2025-14523
Published: 2025-12-11
Description: A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.
CVSS Score: 8.2 (HIGH)
CWE: CWE-444
References: https://access.redhat.com/errata/RHSA-2026:0421; https://access.redhat.com/errata/RHSA-2026:0422; https://access.redhat.com/errata/RHSA-2026:0423
CVE: CVE-2025-14516
Published: 2025-12-11
Description: A vulnerability was found in Yalantis uCrop 2.2.11. Affected by this issue is the function downloadFile of the file com.yalantis.ucrop.task.BitmapLoadTask.java of the component URL Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b[PII_REDACTED]804dae69edf96b942446; https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b[PII_REDACTED]804dae69edf96b942446?pvs=25#039fe30a92dc4ed88c9b03f85418e92e; https://vuldb.com/?ctiid.335854
CVE: CVE-2025-14517
Published: 2025-12-11
Description: A vulnerability was determined in Yalantis uCrop 2.2.11. This affects the function UCropActivity  of the file AndroidManifest.xml. Executing manipulation can lead to improper export of android application components. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b[PII_REDACTED]804dae69edf96b942446#469832583e0444dcb3d08b0ca661d1c6; https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b[PII_REDACTED]804dae69edf96b942446?source=copy_link; https://vuldb.com/?ctiid.335855