deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5660
Published: 2025-06-05
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Complaint Management System 2.0. Affected by this issue is some unknown functionality of the file /user/register-complaint.php. The manipulation of the argument noc leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/49; https://phpgurukul.com/; https://vuldb.com/?ctiid.311150
CVE: CVE-2025-0691
Published: 2025-06-05
Description: Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2025-0011/
CVE: CVE-2025-27445
Published: 2025-06-05
Description: A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered. This vulnerability allows authenticated users to read arbitrary files outside the Joomla root directory. The flaw is caused by insufficient sanitization of user-supplied input in file path parameters, allowing attackers to exploit directory traversal sequences (e.g., ../) to access sensitive files
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-35
References: https://rsjoomla.com/
CVE: CVE-2025-27753
Published: 2025-06-05
Description: A SQLi vulnerability in RSMediaGallery component 1.7.4 - 2.1.6 for Joomla was discovered. The vulnerability is due to the use of unescaped user-supplied parameters in SQL queries within the dashboard component. This allows an authenticated attacker to inject malicious SQL code through unsanitized input fields, which are used directly in SQL queries. Exploiting this flaw can lead to unauthorized database access, data leakage, or modification of records.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://rsjoomla.com/
CVE: CVE-2025-27754
Published: 2025-06-05
Description: A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered. The vulnerability allows authenticated users to inject malicious JavaScript into the plugin's resource. The injected payload is stored by the application and later executed when other users view the affected content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://rsjoomla.com/
CVE: CVE-2025-30084
Published: 2025-06-05
Description: A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard  component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://rsjoomla.com/
CVE: CVE-2025-3768
Published: 2025-06-05
Description: Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking feature when the Devolutions hosted endpoint is not reachable.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2025-0011/
CVE: CVE-2025-47827
Published: 2025-06-05
Description: In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-347
References: https://github.com/Zedeldi/CVE-2025-47827; https://github.com/Zedeldi/igelfs; https://github.com/Zedeldi/CVE-2025-47827
CVE: CVE-2025-5382
Published: 2025-06-05
Description: Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2025-0011/
CVE: CVE-2025-5661
Published: 2025-06-05
Description: A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. This affects an unknown part of the file /save-settings.php of the component Setting Handler. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/tuooo/CVE/issues/2; https://vuldb.com/?ctiid.311151
CVE: CVE-2025-5663
Published: 2025-06-05
Description: A vulnerability has been found in PHPGurukul Auto Taxi Stand Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search-autoortaxi.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Pjwww13447/pjwww/issues/20; https://phpgurukul.com/; https://vuldb.com/?ctiid.311152
CVE: CVE-2025-5664
Published: 2025-06-05
Description: A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the component RESTART Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-e18bb6a8ab3c9991cf4de291efced47f926725e0d76b9d0cfb0c3a1835f99ce3.txt; https://vuldb.com/?ctiid.311153; https://vuldb.com/?id.311153
CVE: CVE-2025-5665
Published: 2025-06-05
Description: A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component XCWD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-e4f6f2a0b9cd918ca9c6dbdb1098d674b121997846a06f423d0023084f7cf3df.txt; https://vuldb.com/?ctiid.311154; https://vuldb.com/?id.311154
CVE: CVE-2025-5666
Published: 2025-06-05
Description: A vulnerability was found in FreeFloat FTP Server 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component XMKD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-8d9aefc49c178ba5c5d3f5464ff43e8e981c28b95c2cf867d3e20c17f4b9f994.txt; https://vuldb.com/?ctiid.311155; https://vuldb.com/?id.311155
CVE: CVE-2025-5667
Published: 2025-06-05
Description: A vulnerability was found in FreeFloat FTP Server 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the component REIN Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-28d5c2bfb3678b7195e43efb6617f46439a1b1cb7e36b7891094a8ad7f8193dc.txt; https://vuldb.com/?ctiid.311156; https://vuldb.com/?id.311156
CVE: CVE-2025-48493
Published: 2025-06-05
Description: The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://github.com/yiisoft/yii2-redis/commit/962252d2c57c187181e67bb66da3f27b4698358d; https://github.com/yiisoft/yii2-redis/security/advisories/GHSA-g3p6-82vc-43jh
CVE: CVE-2025-49009
Published: 2025-06-05
Description: Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-532
References: https://github.com/Erudika/para/commit/46a908d887da[PII_REDACTED]3f70a69345f04887cf; https://github.com/Erudika/para/security/advisories/GHSA-qx7g-fx8q-545g
CVE: CVE-2025-5668
Published: 2025-06-05
Description: A vulnerability classified as critical has been found in PHPGurukul Medical Card Generation System 1.0. This affects an unknown part of the file /admin/readenq.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/50; https://phpgurukul.com/; https://vuldb.com/?ctiid.311157
CVE: CVE-2025-5669
Published: 2025-06-05
Description: A vulnerability classified as critical was found in PHPGurukul Medical Card Generation System 1.0. This vulnerability affects unknown code of the file /admin/unreadenq.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/51; https://phpgurukul.com/; https://vuldb.com/?ctiid.311158
CVE: CVE-2025-5670
Published: 2025-06-05
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Medical Card Generation System 1.0. This issue affects some unknown processing of the file /admin/manage-card.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/52; https://phpgurukul.com/; https://vuldb.com/?ctiid.311159
CVE: CVE-2025-46257
Published: 2025-06-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-46258
Published: 2025-06-05
Description: Missing Authorization vulnerability in BdThemes Element Pack Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Pack Pro: from n/a before 8.0.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-5671
Published: 2025-06-05
Description: A vulnerability, which was classified as critical, was found in TOTOLINK N302R Plus up to 3.4.0-B20201028. Affected is an unknown function of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/byxs0x0/cve2/blob/main/530/1.md; https://vuldb.com/?ctiid.311160; https://vuldb.com/?id.311160
CVE: CVE-2025-5672
Published: 2025-06-05
Description: A vulnerability has been found in TOTOLINK N302R Plus up to 3.4.0-B20201028 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/byxs0x0/cve2/blob/main/530/2.md; https://vuldb.com/?ctiid.311161; https://vuldb.com/?id.311161
CVE: CVE-2025-5674
Published: 2025-06-05
Description: A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file urinalysis_form.php. The manipulation of the argument urinalysis_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yuyuchenchen/vuln-pdf/blob/main/0603CVE.pdf; https://vuldb.com/?ctiid.311162
CVE: CVE-2025-5675
Published: 2025-06-05
Description: A vulnerability was found in Campcodes Online Teacher Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file /trms/admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/modestHonK/cve/issues/1; https://vuldb.com/?ctiid.311163; https://vuldb.com/?id.311163
CVE: CVE-2025-5676
Published: 2025-06-05
Description: A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/hyx123123/cve/issues/2; https://vuldb.com/?ctiid.311164; https://vuldb.com/?id.311164
CVE: CVE-2025-5677
Published: 2025-06-05
Description: A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/ajax.php?action=save_application. The manipulation of the argument position_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/hyx123123/cve/issues/1; https://vuldb.com/?ctiid.311165; https://vuldb.com/?id.311165
CVE: CVE-2025-5679
Published: 2025-06-05
Description: A vulnerability classified as critical has been found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected is the function parseStrByFreeMarker of the file /src/main/java/com/dstz/sys/rest/controller/SysToolsController.java. The manipulation of the argument str leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://gitee.com/agile-bpm/agile-bpm-basic/issues/ICAQWG; https://vuldb.com/?ctiid.311166; https://vuldb.com/?id.311166
CVE: CVE-2025-5702
Published: 2025-06-05
Description: The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-665
References: https://sourceware.org/bugzilla/show_bug.cgi?id=33056
CVE: CVE-2025-43026
Published: 2025-06-05
Description: A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.44.18.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]8008-16/hpsbgn04022
CVE: CVE-2025-5680
Published: 2025-06-05
Description: A vulnerability classified as critical was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected by this vulnerability is the function executeScript of the file /src/main/java/com/dstz/sys/rest/controller/SysScriptController.java of the component Groovy Script Handler. The manipulation of the argument script leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://gitee.com/agile-bpm/agile-bpm-basic/issues/ICAPT5; https://vuldb.com/?ctiid.311167; https://vuldb.com/?id.311167
CVE: CVE-2025-5685
Published: 2025-06-05
Description: A vulnerability, which was classified as critical, was found in Tenda CH22 1.0.0.1. This affects the function formNatlimit of the file /goform/Natlimit. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/xubeining/Cve_report/blob/main/A%20remote%20code%20execution%20vulnerability%20in%20the%20router%20CH22%20V1.0.0.1%20manufactured%20by%20Shenzhen%20Jixiangtengda%20Technology%20Co.%2C%20Ltd1.md; https://vuldb.com/?ctiid.311169; https://vuldb.com/?id.311169
CVE: CVE-2025-5693
Published: 2025-06-05
Description: A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /bwdates-report-result.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/53; https://phpgurukul.com/; https://vuldb.com/?ctiid.311209
CVE: CVE-2025-5745
Published: 2025-06-05
Description: The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-665
References: https://sourceware.org/bugzilla/show_bug.cgi?id=33060
CVE: CVE-2025-47966
Published: 2025-06-05
Description: Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47966
CVE: CVE-2025-48133
Published: 2025-06-05
Description: Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through <= 6.4.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-6-5-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-5694
Published: 2025-06-05
Description: A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /search-report-result.php. The manipulation of the argument serachdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/54; https://phpgurukul.com/; https://vuldb.com/?ctiid.311210
CVE: CVE-2025-5695
Published: 2025-06-05
Description: A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. This impacts the function subscribe_to_spot/subscribe_to_delta/subscribe_to_alarm of the file /usr/www/application/models/subscriptions.php of the component Backend. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 will fix this issue. It is suggested to upgrade the affected component. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://flir.custhelp.com/app/account/fl_download_software; https://github.com/YZS17/CVE/blob/main/Command%20injection%20vulnerability%20in%20subscribe_to_delta()%20in%20FLIR%20AX8.md; https://github.com/YZS17/CVE/blob/main/Command%20injection%20vulnerability%20in%20subscribe_to_spot()%20in%20FLIR%20AX8.md
CVE: CVE-2025-5696
Published: 2025-06-05
Description: A vulnerability classified as critical was found in Brilliance Golden Link Secondary System up to 20250424. This vulnerability affects unknown code of the file /storagework/rentChangeCheckInfoPage.htm. The manipulation of the argument clientname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E9%BB%84%E9%87%91%E9%80%9Astorageworkrent-ChangeCheckInfoPage.htm.md; https://vuldb.com/?ctiid.311212; https://vuldb.com/?id.311212
CVE: CVE-2025-5697
Published: 2025-06-05
Description: A vulnerability, which was classified as critical, has been found in Brilliance Golden Link Secondary System up to 20250424. This issue affects some unknown processing of the file /reprotframework/tcCustDeferPosiQuery.htm. The manipulation of the argument custTradeId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E9%BB%84%E9%87%91%E9%80%9Astorageworkrent-tcCustDeferPosiQuery.md; https://vuldb.com/?ctiid.311213; https://vuldb.com/?id.311213
CVE: CVE-2025-5698
Published: 2025-06-05
Description: A vulnerability, which was classified as critical, was found in Brilliance Golden Link Secondary System up to 20250424. Affected is an unknown function of the file /sysframework/logSelect.htm. The manipulation of the argument nodename leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E9%BB%84%E9%87%91%E9%80%9Asysframework-logSelect.htm.md; https://vuldb.com/?ctiid.311214; https://vuldb.com/?id.311214