deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-11231
Published: 2024-11-23
Description: The 우커머스 네이버페이 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mnp_purchase shortcode in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/mshop-npay/trunk/templates/shortcodes/naverpay-button.php#L6; https://plugins.trac.wordpress.org/changeset/3191814/; https://wordpress.org/plugins/mshop-npay/#developers
CVE: CVE-2024-11631
Published: 2024-11-23
Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /expedit.php. The manipulation of the argument expcat leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/sil3n/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.285917
CVE: CVE-2023-7299
Published: 2024-11-23
Description: A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/datageartech/datagear/issues/29; https://vuldb.com/?ctiid.285658; https://vuldb.com/?id.285658
CVE: CVE-2024-11632
Published: 2024-11-23
Description: A vulnerability was found in code-projects Simple Car Rental System 1.0. It has been classified as critical. Affected is an unknown function of the file /book_car.php. The manipulation of the argument fname/id_no/gender/email/phone/location leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "fname" to be affected. Further analysis indicates that other arguments might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/sil3n/cve/issues/2; https://vuldb.com/?ctiid.285918
CVE: CVE-2024-35160
Published: 2024-11-23
Description: IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to obtain sensitive information due to insufficient session expiration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-613
References: https://www.ibm.com/support/pages/node/7168703; https://www.ibm.com/support/pages/node/7176947
CVE: CVE-2024-11234
Published: 2024-11-24
Description: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-74
References: https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2; https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-11236
Published: 2024-11-24
Description: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-190
References: https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv; https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-11233
Published: 2024-11-24
Description: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43; https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-53899
Published: 2024-11-24
Description: virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://github.com/pypa/virtualenv/issues/2768; https://github.com/pypa/virtualenv/pull/2771; https://github.com/pypa/virtualenv/releases/tag/20.26.6
CVE: CVE-2024-53901
Published: 2024-11-24
Description: The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-120
References: https://github.com/briandfoy/cpan-security-advisory/issues/167; https://github.com/briandfoy/cpan-security-advisory/issues/171; https://github.com/tonycoz/imager/issues/534
CVE: CVE-2024-53909
Published: 2024-11-24
Description: An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS24-014
CVE: CVE-2024-53910
Published: 2024-11-24
Description: An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS24-014
CVE: CVE-2024-53911
Published: 2024-11-24
Description: An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS24-014
CVE: CVE-2024-53912
Published: 2024-11-24
Description: An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS24-014
CVE: CVE-2024-53913
Published: 2024-11-24
Description: An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS24-014
CVE: CVE-2024-53914
Published: 2024-11-24
Description: An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS24-014
CVE: CVE-2024-53915
Published: 2024-11-24
Description: An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.veritas.com/content/support/en_US/security/VTS24-014
CVE: CVE-2024-11665
Published: 2024-11-24
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in hardy-barth cph2_echarge_firmware allows OS Command Injection.This issue affects cph2_echarge_firmware: through 2.0.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.onekey.com/resource/critical-vulnerabilities-in-ev-charging-stations-analysis-of-echarge-controllers
CVE: CVE-2024-11666
Published: 2024-11-24
Description: Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users  suitably positioned on the network between an EV charger controller and eCharge infrastructure can execute arbitrary commands with elevated privileges on affected devices.

This issue affects cph2_echarge_firmware: through 2.0.4.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-345, CWE-345
References: https://www.onekey.com/resource/critical-vulnerabilities-in-ev-charging-stations-analysis-of-echarge-controllers
CVE: CVE-2024-11646
Published: 2024-11-25
Description: A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit-services.php. The manipulation of the argument sername leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/ppp-src/CVE/issues/33; https://vuldb.com/?ctiid.285967
CVE: CVE-2024-53916
Published: 2024-11-25
Description: In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects that do not belong to the tenant, and this action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before 25.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://github.com/openstack/neutron/blob/363ffa6e9e1ab5968f87d45bc2f1cb6394f48b9f/neutron/extensions/tagging.py#L138-L232; https://review.opendev.org/c/openstack/neutron/+/935883; https://review.opendev.org/q/project:openstack/neutron
CVE: CVE-2024-11647
Published: 2024-11-25
Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/ppp-src/CVE/issues/34; https://vuldb.com/?ctiid.285968
CVE: CVE-2024-11648
Published: 2024-11-25
Description: A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-customer.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/Calmgh/CVE/issues/1; https://vuldb.com/?ctiid.285969
CVE: CVE-2024-11649
Published: 2024-11-25
Description: A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/zgaz/CVE/issues/1; https://vuldb.com/?ctiid.285970
CVE: CVE-2024-11650
Published: 2024-11-25
Description: A vulnerability was found in Tenda i9 1.0.0.8(3828) and classified as critical. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404, CWE-476, CWE-476
References: https://github.com/xiaobor123/tenda-vul-i9; https://vuldb.com/?ctiid.285971; https://vuldb.com/?id.285971
CVE: CVE-2024-11651
Published: 2024-11-25
Description: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been classified as critical. Affected is an unknown function of the file /admin/network/wifi_schedule. The manipulation of the argument wifi_schedule_day_em_5 leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://k9u7kv33ub.feishu.cn/wiki/XIepwv7goiCcYxk5QAgc8Q2LnMc?from=from_copylink; https://vuldb.com/?ctiid.285972; https://vuldb.com/?id.285972
CVE: CVE-2024-11652
Published: 2024-11-25
Description: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/sn_package/sn_https. The manipulation of the argument https_enable leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://k9u7kv33ub.feishu.cn/wiki/Rf7wwXMpQiJkp8kp4pmcZb2tnPe; https://vuldb.com/?ctiid.285973; https://vuldb.com/?id.285973
CVE: CVE-2024-53930
Published: 2024-11-25
Description: WikiDocs before 1.0.65 allows stored XSS by authenticated users via data that comes after $$\\, which is mishandled by a KaTeX parser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Zavy86/WikiDocs/commit/aa264bd046a254522da67600be73791bd4e5dafc; https://github.com/Zavy86/WikiDocs/compare/1.0.64...1.0.65; https://github.com/Zavy86/WikiDocs/issues/211
CVE: CVE-2024-11483
Published: 2024-11-25
Description: A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: https://access.redhat.com/errata/RHSA-2024:11145; https://access.redhat.com/security/cve/CVE-2024-11483; https://bugzilla.redhat.com/show_bug.cgi?id=2327579
CVE: CVE-2024-11653
Published: 2024-11-25
Description: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/network/diag_traceroute. The manipulation of the argument diag_traceroute leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://k9u7kv33ub.feishu.cn/wiki/AHPnwdCaoiaQ3fkrdeUcqPfLnEd; https://vuldb.com/?ctiid.285974; https://vuldb.com/?id.285974
CVE: CVE-2024-11654
Published: 2024-11-25
Description: A vulnerability classified as critical has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This affects an unknown part of the file /admin/network/diag_traceroute6. The manipulation of the argument diag_traceroute6 leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://k9u7kv33ub.feishu.cn/wiki/YrKfwHqLjijPeYkMTQfcdhrBnyg?from=from_copylink; https://vuldb.com/?ctiid.285975; https://vuldb.com/?id.285975
CVE: CVE-2020-11311
Published: 2024-11-25
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as duplicate. All references should point to CVE-2021-1904.
CVE: CVE-2024-11655
Published: 2024-11-25
Description: A vulnerability classified as critical was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This vulnerability affects unknown code of the file /admin/network/diag_pinginterface. The manipulation of the argument diag_ping leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://k9u7kv33ub.feishu.cn/wiki/PpM6w3TF8ilK3Ek5RLqcLPUrn6c; https://vuldb.com/?ctiid.285976; https://vuldb.com/?id.285976
CVE: CVE-2024-11656
Published: 2024-11-25
Description: A vulnerability, which was classified as critical, has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This issue affects some unknown processing of the file /admin/network/diag_ping6. The manipulation of the argument diag_ping6 leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://k9u7kv33ub.feishu.cn/wiki/FBJCwjFPZiY4aakElh6cwF25nff; https://vuldb.com/?ctiid.285977; https://vuldb.com/?id.285977
CVE: CVE-2024-10709
Published: 2024-11-25
Description: The YaDisk Files WordPress plugin through 1.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/114aeaf7-32a5-4510-a497-92cc0951b022/
CVE: CVE-2024-10710
Published: 2024-11-25
Description: The YaDisk Files WordPress plugin through 1.2.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/165ab698-c8b5-4412-a621-c5365d621fc5/
CVE: CVE-2024-11657
Published: 2024-11-25
Description: A vulnerability, which was classified as critical, was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. Affected is an unknown function of the file /admin/network/diag_nslookup. The manipulation of the argument diag_nslookup leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://k9u7kv33ub.feishu.cn/wiki/RURswTkepiuKCzkGMd2cA1M2nNc; https://vuldb.com/?ctiid.285978; https://vuldb.com/?id.285978
CVE: CVE-2024-11658
Published: 2024-11-25
Description: A vulnerability has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/network/ajax_getChannelList. The manipulation of the argument countryCode leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://k9u7kv33ub.feishu.cn/wiki/VyKHwBhydiyeuDkATo9cFZTDnHb; https://vuldb.com/?ctiid.285979; https://vuldb.com/?id.285979
CVE: CVE-2024-6393
Published: 2024-11-25
Description: The Photo Gallery, Sliders, Proofing and   WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/126d1dd7-d332-47c8-ad25-5fbe211313b0/
CVE: CVE-2024-7056
Published: 2024-11-25
Description: The WPForms  WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/467af13e-25bd-425c-929d-5dd06e28d595/
CVE: CVE-2024-11659
Published: 2024-11-25
Description: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/network/diag_iperf. The manipulation of the argument iperf leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://k9u7kv33ub.feishu.cn/wiki/OhR6w0THjiFeV1kSfZncaCxTn7f?from=from_copylink; https://vuldb.com/?ctiid.285980; https://vuldb.com/?id.285980
CVE: CVE-2024-11660
Published: 2024-11-25
Description: A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file usuario.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/evo-ose/cve/blob/main/xss9.md; https://vuldb.com/?ctiid.285981