deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-3163
Published: 2025-04-03
Description: A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74, CWE-94, CWE-94
References: https://github.com/InternLM/lmdeploy/issues/3254; https://github.com/InternLM/lmdeploy/issues/3254#issue[PII_REDACTED]; https://vuldb.com/?ctiid.303109
CVE: CVE-2025-3164
Published: 2025-04-03
Description: A vulnerability was found in Tencent Music Entertainment SuperSonic up to 0.9.8. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/semantic/database/testConnect of the component H2 Database Connection Handler. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-94, CWE-94
References: https://github.com/tencentmusic/supersonic/issues/2193; https://github.com/tencentmusic/supersonic/issues/2193#issue[PII_REDACTED]; https://vuldb.com/?ctiid.303110
CVE: CVE-2025-3165
Published: 2025-04-03
Description: A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chitu/backend.py. The manipulation of the argument ckpt_path/quant_ckpt_dir leads to deserialization. An attack has to be approached locally.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://github.com/thu-pacman/chitu/issues/32; https://vuldb.com/?ctiid.303111; https://vuldb.com/?id.303111
CVE: CVE-2023-47639
Published: 2025-04-03
Description: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/api-platform/core/commit/ba8a7e6538bccebf14c228e43a9339214c4d9201; https://github.com/api-platform/core/pull/5823; https://github.com/api-platform/core/security/advisories/GHSA-rfw5-cqjj-7v9r
CVE: CVE-2025-31115
Published: 2025-04-03
Description: XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.
CWE: CWE-366, CWE-416, CWE-476, CWE-826
References: https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480; https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2; https://tukaani.org/xz/xz-cve-2025-31115.patch
CVE: CVE-2025-32054
Published: 2025-04-03
Description: In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-3166
Published: 2025-04-03
Description: A vulnerability classified as critical was found in code-projects Product Management System 1.0. This vulnerability affects the function search_item of the component Search Product Menu. The manipulation of the argument target leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/zzzxc643/cve_Product-Management-System/blob/main/cve.md; https://vuldb.com/?ctiid.303112
CVE: CVE-2025-3167
Published: 2025-04-03
Description: A vulnerability, which was classified as problematic, has been found in Tenda AC23 16.03.07.52. This issue affects some unknown processing of the file /goform/VerAPIMant of the component API Interface. The manipulation of the argument getuid leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://github.com/LZY0522/CVE/blob/main/CVE_1.md; https://vuldb.com/?ctiid.303113; https://vuldb.com/?id.303113
CVE: CVE-2025-3168
Published: 2025-04-03
Description: A vulnerability was found in PHPGurukul Time Table Generator System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit-class.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.303127
CVE: CVE-2025-3169
Published: 2025-04-03
Description: A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/saveAttachment.php. The manipulation of the argument attachmentFiles leads to unrestricted upload. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 12.0.3 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains, that "this vulnerability can be exploited only on not securely installed instances, as it is adviced during product install: attachment directory should be out of web reach, so that even if executable file can be uploaded, it cannot be executed through the web."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/deadmilkman/cve-reports/blob/main/01-projeqtor-rce/readme.md; https://github.com/deadmilkman/cve-reports/blob/main/01-projeqtor-rce/readme.md#proof-of-concept-poc; https://vuldb.com/?ctiid.303128
CVE: CVE-2025-31126
Published: 2025-04-03
Description: Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/element-hq/element-meta/issues/2441; https://github.com/element-hq/element-x-ios/security/advisories/GHSA-69qf-p24v-rf8j
CVE: CVE-2025-31127
Published: 2025-04-03
Description: Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/element-hq/element-meta/issues/2441; https://github.com/element-hq/element-x-android/security/advisories/GHSA-x2g5-f28j-p7w6
CVE: CVE-2025-31483
Published: 2025-04-03
Description: Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.
CWE: CWE-79
References: https://github.com/miniflux/v2/commit/cb695e653a08af4cabcb277c271ce74bd0c746e6; https://github.com/miniflux/v2/security/advisories/GHSA-cq88-842x-2jhp
CVE: CVE-2025-3170
Published: 2025-04-03
Description: A vulnerability classified as critical has been found in Project Worlds Online Lawyer Management System 1.0. This affects an unknown part of the file /admin_user.php. The manipulation of the argument block_id/unblock_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/3; https://github.com/p1026/CVE/issues/4; https://vuldb.com/?ctiid.303129
CVE: CVE-2025-3171
Published: 2025-04-03
Description: A vulnerability classified as critical was found in Project Worlds Online Lawyer Management System 1.0. This vulnerability affects unknown code of the file /approve_lawyer.php. The manipulation of the argument unblock_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/5; https://vuldb.com/?ctiid.303130; https://vuldb.com/?id.303130
CVE: CVE-2025-3172
Published: 2025-04-03
Description: A vulnerability, which was classified as critical, has been found in Project Worlds Online Lawyer Management System 1.0. This issue affects some unknown processing of the file /lawyer_booking.php. The manipulation of the argument unblock_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/p1026/CVE/issues/6; https://vuldb.com/?ctiid.303131; https://vuldb.com/?id.303131
CVE: CVE-2024-22611
Published: 2025-04-03
Description: OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/baolqinfosec/CVE-Reseach/blob/main/OpenERM_CVE-2024-22611.md
CVE: CVE-2025-29647
Published: 2025-04-03
Description: SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/B00W_NSD/poc/blob/master/seacms13.3-sql/poc.md
CVE: CVE-2025-31486
Published: 2025-04-03
Description: Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290; https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647; https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
CVE: CVE-2025-31487
Published: 2025-04-03
Description: The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example). The vulnerability has been patched in the JIRA Extension v8.6.5.
CVSS Score: 7.7 (HIGH)
CWE: CWE-611
References: https://github.com/xwiki-contrib/jira/commit/5049e352d16f8356734de70daf1202301f170ee6; https://github.com/xwiki-contrib/jira/commit/98a74c2a516b42689c73b13ecd94e9c1998fa9cb; https://github.com/xwiki-contrib/jira/security/advisories/GHSA-wc53-4255-gw3f
CVE: CVE-2025-3173
Published: 2025-04-03
Description: A vulnerability, which was classified as critical, was found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the file /save_booking.php. The manipulation of the argument lawyer_id/description leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/7; https://vuldb.com/?ctiid.303132; https://vuldb.com/?id.303132
CVE: CVE-2025-3174
Published: 2025-04-03
Description: A vulnerability has been found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /searchLawyer.php. The manipulation of the argument experience leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/8; https://vuldb.com/?ctiid.303133; https://vuldb.com/?id.303133
CVE: CVE-2025-3175
Published: 2025-04-03
Description: A vulnerability was found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /save_user_edit_profile.php. The manipulation of the argument first_Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/p1026/CVE/issues/9; https://vuldb.com/?ctiid.303134; https://vuldb.com/?id.303134
CVE: CVE-2024-45198
Published: 2025-04-03
Description: insightsoftware Spark JDBC 2.6.21 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://gist.github.com/azraelxuemo/ef11311ae0633cbd3d794f73c64e3877
CVE: CVE-2025-26817
Published: 2025-04-03
Description: Netwrix Password Secure 9.2.0.32454 allows OS command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://helpcenter.netwrix.com/bundle/PasswordSecure_9.2_ReleaseNotes/resource/Netwrix_PasswordSecure_9.2_BugFixList.pdf; https://security.netwrix.com/advisories/adv-2025-009; https://www.8com.de/cyber-security-blog/authenticated-remote-code-execution-in-netwrix-password-secure-cve-2025-26817
CVE: CVE-2025-26818
Published: 2025-04-03
Description: Netwrix Password Secure through 9.2 allows command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://helpcenter.netwrix.com/bundle/PasswordSecure_9.2_ReleaseNotes/resource/Netwrix_PasswordSecure_9.2_BugFixList.pdf; https://security.netwrix.com/advisories/adv-2025-009
CVE: CVE-2025-29064
Published: 2025-04-03
Description: An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/kn0sky/cve/blob/main/TOTOLINK%20X18/OS%20Command%20Injection%20setLanguageCfg_lang.md; https://github.com/kn0sky/cve/blob/main/TOTOLINK%20X18/OS%20Command%20Injection%20setLanguageCfg_lang.md
CVE: CVE-2025-29462
Published: 2025-04-03
Description: A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability occurs when the webCgiGetUploadFile function calls the socketRead function to process HTTP request messages, resulting in the overwriting of a buffer on the stack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://hackmd.io/@7QWW9EKUSNGgPWZNOHkL2w/Sk4xbvejyx
CVE: CVE-2025-29504
Published: 2025-04-03
Description: Insecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://gitee.com/huang-yk/student-manage/issues/IBQ14H
CVE: CVE-2025-29570
Published: 2025-04-03
Description: An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_image_check of a binary named rc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/IOTRes/IOT_Firmware_Update/blob/main/firmwareupdate.md
CVE: CVE-2025-30406
Published: 2025-04-03
Description: Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-321, CWE-798
References: https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf; https://www.centrestack.com/p/gce_latest_release.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30406
CVE: CVE-2025-31119
Published: 2025-04-03
Description: generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath and also has access to these REST interface for calling the mentioned REST endpoints, using these lines of code can lead to unintended remote code execution. This vulnerability is fixed in 5.9.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-470
References: https://github.com/jhipster/generator-jhipster-entity-audit/blob/e21e83135d10c77d92203c89cb0b0063914e8fe0/generators/spring-boot-javers/templates/src/main/java/_package_/web/rest/JaversEntityAuditResource.java.ejs#L88; https://github.com/jhipster/generator-jhipster-entity-audit/security/advisories/GHSA-7rmp-3g9f-cvq8
CVE: CVE-2025-31161
Published: 2025-04-03
Description: CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305
References: https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo; https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/; https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
CVE: CVE-2025-31481
Published: 2025-04-03
Description: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb; https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568; https://github.com/api-platform/core/releases/tag/v3.4.17
CVE: CVE-2025-31485
Published: 2025-04-03
Description: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.
CVSS Score: 7.5 (HIGH)
CWE: CWE-696
References: https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8; https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a; https://github.com/api-platform/core/releases/tag/v3.4.17
CVE: CVE-2025-31489
Published: 2025-04-03
Description: MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access
to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.
CWE: CWE-347
References: https://github.com/minio/minio/pull/21103; https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh
CVE: CVE-2025-3176
Published: 2025-04-03
Description: A vulnerability was found in Project Worlds Online Lawyer Management System 1.0. It has been classified as critical. This affects an unknown part of the file /single_lawyer.php. The manipulation of the argument u_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/10; https://vuldb.com/?ctiid.303135; https://vuldb.com/?id.303135
CVE: CVE-2025-3177
Published: 2025-04-03
Description: A vulnerability was found in FastCMS 0.1.5. It has been declared as critical. This vulnerability affects unknown code of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-320, CWE-321
References: https://github.com/chujianxin0101/vuln/issues/2; https://vuldb.com/?ctiid.303136; https://vuldb.com/?id.303136
CVE: CVE-2024-45199
Published: 2025-04-03
Description: insightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://gist.github.com/azraelxuemo/d019ad079d540ef28870dbd9552a7c62