deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-55710
Published: 2025-08-14
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Steve Burge TaxoPress simple-tags allows Retrieve Embedded Sensitive Data.This issue affects TaxoPress: from n/a through <= 3.37.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/simple-tags/vulnerability/wordpress-taxopress-plugin-plugin-3-37-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-55711
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Stored XSS.This issue affects WP Table Builder: from n/a through <= 2.0.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-table-builder/vulnerability/wordpress-wp-table-builder-plugin-plugin-2-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-55712
Published: 2025-08-14
Description: Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 6.3.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-page-builder-lite-plugin-plugin-6-3-13-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-55713
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy allows Stored XSS.This issue affects Blocksy: from n/a through <= 2.1.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/blocksy/vulnerability/wordpress-blocksy-theme-theme-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-55714
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-plugin-2-7-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-55716
Published: 2025-08-14
Description: Missing Authorization vulnerability in VeronaLabs WP Statistics wp-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Statistics: from n/a through <= 14.15.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-statistics/vulnerability/wordpress-wp-statistics-plugin-plugin-14-15-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-8975
Published: 2025-08-14
Description: A vulnerability was identified in givanz Vvveb up to 1.0.5. This affects an unknown part of the file admin/template/content/edit.tpl. The manipulation of the argument slug leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The patch is named 84c11d69df8452dc378feecd17e2a62ac10dac66. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://gist.github.com/0xHamy/b2674eeffd1f73af96d29f152c47bcbd; https://github.com/givanz/Vvveb/commit/84c11d69df8452dc378feecd17e2a62ac10dac66; https://github.com/givanz/Vvveb/releases/tag/1.0.6
CVE: CVE-2025-8976
Published: 2025-08-14
Description: A vulnerability has been found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/index.php?module=content/post&type=post of the component Endpoint. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/givanz/Vvveb/releases/tag/1.0.6; https://hkohi.ca/vulnerability/7; https://vuldb.com/?ctiid.319972
CVE: CVE-2025-8978
Published: 2025-08-14
Description: A vulnerability was determined in D-Link DIR-619L 6.02CN02. Affected is the function FirmwareUpgrade of the component boa. The manipulation leads to insufficient verification of data authenticity. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-345
References: https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Dlink/DIR619L.md; https://vuldb.com/?ctiid.319974; https://vuldb.com/?id.319974
CVE: CVE-2025-50861
Published: 2025-08-14
Description: The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication via ADB or malicious apps. This poses a risk of unintended access to application internals and can cause denial of service or logic abuse.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-400
References: http://comlotuscarsdomesticintl.com; http://lotus.com; https://github.com/JackSessions/Jack-Sessions-CVEs/tree/main
CVE: CVE-2025-50862
Published: 2025-08-14
Description: The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB backup on rooted or debug-enabled devices. This presents a risk of user data exposure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://comlotuscarsdomesticintl.com; http://lotus.com; https://github.com/JackSessions/Jack-Sessions-CVEs/tree/main
CVE: CVE-2025-51965
Published: 2025-08-14
Description: OURPHP thru 8.6.1 is vulnerable to Cross-Site Scripting (XSS) via the "Name" field of the "Complete Profile" functionality under the "My User Center" page, which can be accessed after registering through the front-end interface.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://ourphp.com; https://www.ourphp.net/; https://www.yuque.com/hkone-3iknd/sgwwfb/nvi4f00wqh3kyg0z?singleDoc
CVE: CVE-2025-8979
Published: 2025-08-14
Description: A vulnerability was identified in Tenda AC15 15.13.07.13. Affected by this vulnerability is the function check_fw_type/split_fireware/check_fw of the component Firmware Update Handler. The manipulation leads to insufficient verification of data authenticity. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-345
References: https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/AC15_Auth.md; https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/AC15_Inte.md; https://vuldb.com/?ctiid.319975
CVE: CVE-2025-8980
Published: 2025-08-14
Description: A vulnerability has been found in Tenda G1 16.01.7.8(3660). Affected by this issue is the function check_upload_file of the component Firmware Update Handler. The manipulation leads to insufficient verification of data authenticity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-345
References: https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/G1_Auth.md; https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/G1_Inte.md; https://vuldb.com/?ctiid.319976
CVE: CVE-2025-8981
Published: 2025-08-14
Description: A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/operations/payment.php. The manipulation of the argument payment_type leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhuyi-hz/cve/issues/10; https://itsourcecode.com/; https://vuldb.com/?ctiid.319977
CVE: CVE-2025-8982
Published: 2025-08-14
Description: A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/currency.php. The manipulation of the argument curr_code leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhuyi-hz/cve/issues/9; https://itsourcecode.com/; https://vuldb.com/?ctiid.319978
CVE: CVE-2025-8983
Published: 2025-08-14
Description: A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/expense.php. The manipulation of the argument expense_for leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhuyi-hz/cve/issues/8; https://itsourcecode.com/; https://vuldb.com/?ctiid.319979
CVE: CVE-2025-8984
Published: 2025-08-14
Description: A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/operations/expense_category.php. The manipulation of the argument expense_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhuyi-hz/cve/issues/7; https://itsourcecode.com/; https://vuldb.com/?ctiid.319980
CVE: CVE-2025-8985
Published: 2025-08-14
Description: A vulnerability was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhuyi-hz/cve/issues/6; https://vuldb.com/?ctiid.319981; https://vuldb.com/?id.319981
CVE: CVE-2025-8986
Published: 2025-08-14
Description: A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /search-report-result.php. The manipulation of the argument serachdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhuyi-hz/cve/issues/5; https://vuldb.com/?ctiid.319982; https://vuldb.com/?id.319982
CVE: CVE-2025-31987
Published: 2025-08-14
Description: HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-405
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123272
CVE: CVE-2025-8987
Published: 2025-08-14
Description: A vulnerability was identified in SourceCodester COVID 19 Testing Management System 1.0. This affects an unknown part of the file /test-details.php. The manipulation of the argument remark leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhuyi-hz/cve/issues/4; https://vuldb.com/?ctiid.319983; https://vuldb.com/?id.319983
CVE: CVE-2025-8988
Published: 2025-08-14
Description: A vulnerability has been found in SourceCodester COVID 19 Testing Management System 1.0. This vulnerability affects unknown code of the file /bwdates-report-result.php. The manipulation of the argument fromdate leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhuyi-hz/cve/issues/3; https://vuldb.com/?ctiid.319984; https://vuldb.com/?id.319984
CVE: CVE-2025-8989
Published: 2025-08-15
Description: A vulnerability was found in SourceCodester COVID 19 Testing Management System 1.0. This issue affects some unknown processing of the file /edit-phlebotomist.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhuyi-hz/cve/issues/2; https://vuldb.com/?ctiid.319985; https://vuldb.com/?id.319985
CVE: CVE-2025-8990
Published: 2025-08-15
Description: A vulnerability was determined in code-projects Online Medicine Guide 1.0. Affected is an unknown function of the file /browsemdcn.php. The manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zhuyi-hz/cve/issues/1; https://vuldb.com/?ctiid.319986
CVE: CVE-2025-8991
Published: 2025-08-15
Description: A vulnerability was identified in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file /admin/config/express of the component Business Logic Handler. The manipulation of the argument litemall_express_freight_min leads to business logic errors. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840
References: https://github.com/linlinjava/litemall/issues/566; https://github.com/linlinjava/litemall/issues/566#issue[PII_REDACTED]; https://vuldb.com/?ctiid.319987
CVE: CVE-2025-8992
Published: 2025-08-15
Description: A vulnerability has been found in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://gitee.com/mtons/mblog/issues/ICPMGP; https://vuldb.com/?ctiid.319988; https://vuldb.com/?id.319988
CVE: CVE-2025-8993
Published: 2025-08-15
Description: A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/expense_report.php. The manipulation of the argument from_date leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/lin-3-start/lin-cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.319989
CVE: CVE-2025-9000
Published: 2025-08-15
Description: A vulnerability was found in Mechrevo Control Center GX V2 5.56.51.48. Affected by this vulnerability is an unknown functionality of the component reg File Handler. The manipulation leads to uncontrolled search path. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-427, CWE-426
References: https://drive.proton.me/urls/7QYSEW6734#H3N4fQ3mw6gX; https://vuldb.com/?ctiid.320029; https://vuldb.com/?id.320029
CVE: CVE-2025-6025
Published: 2025-08-15
Description: The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for unauthenticated attackers to apply an excessive or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-602
References: https://plugins.trac.wordpress.org/browser/order-tip-woo/trunk/assets/build/front.bundle.js; https://plugins.trac.wordpress.org/browser/order-tip-woo/trunk/frontend/views/tip-form.php#L49; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3318615%40order-tip-woo&new=3318615%40order-tip-woo&sfp_email=&sfph_mail=
CVE: CVE-2025-8342
Published: 2025-08-15
Description: The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.47/login-with-phonenumber.php#L4358; https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.47/login-with-phonenumber.php#L4373; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338150%40login-with-phone-number&new=3338150%40login-with-phone-number&sfp_email=&sfph_mail=
CVE: CVE-2025-8676
Published: 2025-08-15
Description: The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions less than, or equal to, 2.0.0 via the get_active_plugins function. This makes it possible for authenticated attackers, with subscriber-level access and above to extract sensitive data including installed plugin information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.30/adminMenu.php#L83; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3343487%40b-slider&new=3343487%40b-slider&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c19b24ef-cf49-4a5c-a187-0f09ac53c337?source=cve
CVE: CVE-2025-8680
Published: 2025-08-15
Description: The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fs_api_request function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.30/bplugins_sdk/inc/Base/FSActivate.php#L166; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3343487%40b-slider&new=3343487%40b-slider&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ac245316-228e-4508-b3fe-f7071fb1bc8e?source=cve
CVE: CVE-2025-8867
Published: 2025-08-15
Description: The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget parameters in version 3.1.3 and below. This is due to insufficient input sanitization and output escaping on user supplied attributes such as chart categories, titles, and tooltip settings. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/AreaChart.php#L156; https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/ColumnChart.php#L183; https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/DistributeColumnChart.php#L179
CVE: CVE-2025-9001
Published: 2025-08-15
Description: A vulnerability was determined in LemonOS up to nightly-2024-07-12 on LemonOS. Affected by this issue is the function HTTPGet of the file /Applications/Steal/main.cpp of the component HTTP Client. The manipulation of the argument chunkSize leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/LemonOSProject/LemonOS/issues/60; https://hkohi.ca/vulnerability/16; https://vuldb.com/?ctiid.320030
CVE: CVE-2025-9002
Published: 2025-08-15
Description: A vulnerability was identified in Surbowl dormitory-management-php 1.0. This affects an unknown part of the file login.php. The manipulation of the argument Account leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/fatdog957/CVE-/issues/1; https://vuldb.com/?ctiid.320031; https://vuldb.com/?id.320031
CVE: CVE-2025-9003
Published: 2025-08-15
Description: A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component DHCP Reserved Address Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.320032; https://vuldb.com/?id.320032; https://vuldb.com/?submit.628334
CVE: CVE-2025-9004
Published: 2025-08-15
Description: A vulnerability was found in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.7 (LOW)
CWE: CWE-307, CWE-799
References: https://gitee.com/mtons/mblog/issues/ICPMIR; https://vuldb.com/?ctiid.320033; https://vuldb.com/?id.320033
CVE: CVE-2025-9005
Published: 2025-08-15
Description: A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposure through error message. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.7 (LOW)
CWE: CWE-200, CWE-209
References: https://gitee.com/mtons/mblog/issues/ICPMJO; https://vuldb.com/?ctiid.320034; https://vuldb.com/?id.320034