deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-44080
Published: 2024-10-29
Description: In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loading GIFs from any arbitrary URL if a message from another participant contains a URL encoded in the expected format.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/jitsi/jitsi-meet/compare/jitsi-meet_9672...jitsi-meet_9673; https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2024-0002.md
CVE: CVE-2024-44081
Published: 2024-10-29
Description: In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrary URL if a message from another participant contains a URL encoded in the expected format.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://github.com/jitsi/jitsi-meet/compare/jitsi-meet_9672...jitsi-meet_9673; https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2024-0003.md
CVE: CVE-2024-48138
Published: 2024-10-29
Description: A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via injecting a crafted payload into a template.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/pluxml/PluXml/issues/829
CVE: CVE-2024-48572
Published: 2024-10-29
Description: A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against email addresses to find duplicate entries.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2024-48572
CVE: CVE-2024-48573
Published: 2024-10-29
Description: A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2024-48573
CVE: CVE-2024-50421
Published: 2024-10-29
Description: Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 3.8.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-pdf-invoices-packing-slips/vulnerability/wordpress-pdf-invoices-packing-slips-for-woocommerce-plugin-3-8-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-50422
Published: 2024-10-29
Description: Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.1.14.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/breeze/vulnerability/wordpress-breeze-plugin-2-1-14-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-50423
Published: 2024-10-29
Description: Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/templately/vulnerability/wordpress-templately-plugin-3-1-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-50424
Published: 2024-10-29
Description: Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/templately/vulnerability/wordpress-templately-plugin-3-1-5-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2024-50425
Published: 2024-10-29
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Murg WP Booking System wp-booking-system.This issue affects WP Booking System: from n/a through <= 2.0.19.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/wp-booking-system/vulnerability/wordpress-wp-booking-system-plugin-2-0-19-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-50428
Published: 2024-10-29
Description: Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multi Step Form: from n/a through <= 1.7.21.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/multi-step-form/vulnerability/wordpress-multi-step-form-plugin-1-7-21-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-50454
Published: 2024-10-29
Description: Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-seopress/vulnerability/wordpress-seopress-plugin-8-1-1-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-7991
Published: 2024-10-29
Description: A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE: CVE-2024-7992
Published: 2024-10-29
Description: A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force a Stack-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE: CVE-2024-8588
Published: 2024-10-29
Description: A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability.  A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8589
Published: 2024-10-29
Description: A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability.  A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8590
Published: 2024-10-29
Description: A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability.  A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8591
Published: 2024-10-29
Description: A maliciously crafted 3DM file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Heap-Based Buffer Overflow vulnerability.  A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8592
Published: 2024-10-29
Description: A maliciously crafted CATPART file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability.  A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0020
CVE: CVE-2024-8593
Published: 2024-10-29
Description: A maliciously crafted CATPART file, when parsed in ASMKERN230A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8594
Published: 2024-10-29
Description: A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8595
Published: 2024-10-29
Description: A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8596
Published: 2024-10-29
Description: A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8597
Published: 2024-10-29
Description: A maliciously crafted STP file when parsed in ASMDATAX230A.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8598
Published: 2024-10-29
Description: A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8599
Published: 2024-10-29
Description: A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8600
Published: 2024-10-29
Description: A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability.  A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-8896
Published: 2024-10-29
Description: A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-908, CWE-908
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE: CVE-2024-9489
Published: 2024-10-29
Description: A maliciously crafted DWG file when parsed in ACAD.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE: CVE-2024-9826
Published: 2024-10-29
Description: A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-9827
Published: 2024-10-29
Description: A maliciously crafted CATPART file when parsed in CC5Dll.dll through Autodesk AutoCAD can force an Out-of-Bounds Read vulnerability.  A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE: CVE-2024-9996
Published: 2024-10-29
Description: A maliciously crafted DWG file, when parsed in acdb25.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE: CVE-2024-9997
Published: 2024-10-29
Description: A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE: CVE-2024-50348
Published: 2024-10-29
Description: InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3; https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29
CVE: CVE-2024-51378
Published: 2024-10-29
Description: getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://cwe.mitre.org/data/definitions/420.html; https://cwe.mitre.org/data/definitions/78.html; https://cyberpanel.net/KnowledgeBase/home/change-logs/
CVE: CVE-2024-51567
Published: 2024-10-29
Description: upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://cwe.mitre.org/data/definitions/420.html; https://cwe.mitre.org/data/definitions/78.html; https://cyberpanel.net/KnowledgeBase/home/change-logs/
CVE: CVE-2024-51568
Published: 2024-10-29
Description: CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://cwe.mitre.org/data/definitions/78.html; https://cyberpanel.net/KnowledgeBase/home/change-logs/; https://cyberpanel.net/blog/cyberpanel-v2-3-5
CVE: CVE-2024-10500
Published: 2024-10-30
Description: A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. Affected by this issue is some unknown functionality of the file /com/esafenet/servlet/policy/HookWhiteListService.java. The manipulation of the argument policyId leads to sql injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://flowus.cn/share/a582f7be-7e33-41f1-bce9-a1eb3578229f?code=G8A6P3; https://vuldb.com/?ctiid.282440; https://vuldb.com/?id.282440
CVE: CVE-2024-10501
Published: 2024-10-30
Description: A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function findById of the file /com/esafenet/servlet/document/ExamCDGDocService.java. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://flowus.cn/share/95cc2cb9-7ab2-4eba-969f-f836fac1deb4?code=G8A6P3; https://vuldb.com/?ctiid.282441; https://vuldb.com/?id.282441
CVE: CVE-2024-10502
Published: 2024-10-30
Description: A vulnerability has been found in ESAFENET CDG 5 and classified as critical. This vulnerability affects the function getOneFileDirectory of the file /com/esafenet/servlet/fileManagement/FileDirectoryService.java. The manipulation of the argument directoryId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://flowus.cn/share/f1f8c6bd-057f-406b-9421-ab6cee169980?code=G8A6P3; https://vuldb.com/?ctiid.282442; https://vuldb.com/?id.282442
CVE: CVE-2024-10503
Published: 2024-10-30
Description: A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing of the component URL Handler. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.282443; https://vuldb.com/?id.282443; https://vuldb.com/?submit.427302
CVE: CVE-2024-10505
Published: 2024-10-30
Description: A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Initially two separate issues were created by the researcher for the different function calls. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://github.com/wuzhicms/wuzhicms/issues/209; https://vuldb.com/?ctiid.282444; https://vuldb.com/?id.282444
CVE: CVE-2023-5816
Published: 2024-10-30
Description: The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instance, though the intention of the plugin is to only access WordPress related files. This makes it possible for authenticated attackers, with administrator-level access, to read files outside of the WordPress instance.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3234408%40code-explorer&new=3234408%40code-explorer&sfp_email=&sfph_mail=; https://wordpress.org/plugins/code-explorer/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/42ecc4e5-d660-472f-823d-a29b84cdf041?source=cve
CVE: CVE-2024-10506
Published: 2024-10-30
Description: A vulnerability classified as critical has been found in code-projects Blood Bank System 1.0. This affects an unknown part of the file /admin/blood/update/B-.php. The manipulation of the argument Bloodname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/xxx-www/cve/blob/main/sql8.md; https://vuldb.com/?ctiid.282447
CVE: CVE-2024-10507
Published: 2024-10-30
Description: A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/26; https://vuldb.com/?ctiid.282448; https://vuldb.com/?id.282448
CVE: CVE-2024-10509
Published: 2024-10-30
Description: A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/ppp-src/CVE/issues/27; https://vuldb.com/?ctiid.282449; https://vuldb.com/?id.282449