deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12662
Published: 2025-11-11
Description: The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/coon-google-maps/tags/1.0/coon-google-maps.php#L71; https://wordpress.org/plugins/coon-google-maps/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d0eaa0-ad8f-418c-bb61-eb209ba0249b?source=cve
CVE: CVE-2025-12663
Published: 2025-11-11
Description: The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/jeba-cute-forkit/tags/1.0/jeba-forkit-index.php#L58; https://wordpress.org/plugins/jeba-cute-forkit/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d4aa9303-953f-4bc3-8069-8e9a967461a9?source=cve
CVE: CVE-2025-12665
Published: 2025-11-11
Description: The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja_countdown_admin_ajax' AJAX endpoint in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary countdowns.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://wordpress.org/plugins/ninja-countdown/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9b0b6433-5651-4a9d-8356-5d02d51830f4?source=cve
CVE: CVE-2025-12667
Published: 2025-11-11
Description: The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/github-gist-shortcode/tags/0.2/github-gist-shortcode-plugin.php#L33; https://wordpress.org/plugins/github-gist-shortcode/; https://www.wordfence.com/threat-intel/vulnerabilities/id/fc6468bf-37b6-4dd7-b2e5-e880e3cc3c32?source=cve
CVE: CVE-2025-12668
Published: 2025-11-11
Description: The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-count-down-timer/tags/1.0.1/wp-count-down-timer.php#L69; https://wordpress.org/plugins/wp-count-down-timer/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bcbcad73-ce2a-4eb2-9b7f-91d47a93e16d?source=cve
CVE: CVE-2025-12671
Published: 2025-11-11
Description: The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, and including, 0.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-iconics/tags/0.0.4/wp-iconics.php#L47; https://wordpress.org/plugins/wp-iconics/; https://www.wordfence.com/threat-intel/vulnerabilities/id/90ec6c64-f2c6-483e-9d8b-25e65ccb4a90?source=cve
CVE: CVE-2025-12672
Published: 2025-11-11
Description: The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-flickrshow/tags/1.5/flickrshow.php#L230; https://wordpress.org/plugins/wp-flickrshow/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5b792892-25dc-4df0-883d-afd0b47292e0?source=cve
CVE: CVE-2025-12711
Published: 2025-11-11
Description: The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/share-to-google-classroom/tags/1.0/share_to_google_classroom.php#L59; https://www.wordfence.com/threat-intel/vulnerabilities/id/87cc821c-21d5-49b7-9b72-030ca016efd8?source=cve
CVE: CVE-2025-12753
Published: 2025-11-11
Description: The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-80
References: https://plugins.trac.wordpress.org/browser/chart-expert/tags/1.0/inc/shortcode.php#L1; https://plugins.trac.wordpress.org/browser/chart-expert/tags/1.0/inc/shortcode.php#L95; https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed413a9-bf1d-4564-b740-4c92ec2c2249?source=cve
CVE: CVE-2025-12754
Published: 2025-11-11
Description: The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/geopost/tags/1.2/geopost.php#L15; https://plugins.trac.wordpress.org/browser/geopost/tags/1.2/geopost.php#L20; https://www.wordfence.com/threat-intel/vulnerabilities/id/4c38ca9a-895b-4d59-94c9-c7d5ba3b1b7d?source=cve
CVE: CVE-2025-12813
Published: 2025-11-11
Description: The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated attackers to execute code on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/holiday-class-post-calendar/trunk/holiday_class_post_calendar.php#L1234; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3414925%40holiday-class-post-calendar&new=3414925%40holiday-class-post-calendar&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/7f7968c4-589c-4949-9f69-4a0ba4db4ea9?source=cve
CVE: CVE-2025-12880
Published: 2025-11-11
Description: The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/progressmatify-blocks/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc48d4d-eeee-47f7-be5e-0d6a43473aa0?source=cve
CVE: CVE-2025-11237
Published: 2025-11-11
Description: The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/88b46752-051b-4468-9e2b-cc81a9ce1075/
CVE: CVE-2025-11307
Published: 2025-11-11
Description: The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/f5b21a05-7a51-4530-9e07-4700f00eeca3/
CVE: CVE-2025-11855
Published: 2025-11-11
Description: The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/1a16440e-817f-4ec2-9c70-261f6b63fb8a/
CVE: CVE-2025-4645
Published: 2025-11-11
Description: An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1287
References: https://www.axis.com/dam/public/69/47/ff/cve-2025-4645pdf-en-US-504211.pdf
CVE: CVE-2025-5452
Published: 2025-11-11
Description: A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-214
References: https://www.axis.com/dam/public/39/ba/8b/cve-2025-5452pdf-en-US-504212.pdf
CVE: CVE-2025-5454
Published: 2025-11-11
Description: An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-35
References: https://www.axis.com/dam/public/48/ab/82/cve-2025-5454pdf-en-US-504213.pdf
CVE: CVE-2025-5718
Published: 2025-11-11
Description: The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-59
References: https://www.axis.com/dam/public/3c/a4/6a/cve-2025-5718pdf-en-US-504214.pdf
CVE: CVE-2025-6298
Published: 2025-11-11
Description: ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1287
References: https://www.axis.com/dam/public/ef/91/c3/cve-2025-6298pdf-en-US-504215.pdf
CVE: CVE-2025-6571
Published: 2025-11-11
Description: A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-522
References: https://www.axis.com/dam/public/1f/f8/f0/cve-2025-6571pdf-en-US-504216.pdf
CVE: CVE-2025-6779
Published: 2025-11-11
Description: An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732
References: https://www.axis.com/dam/public/92/9a/13/cve-2025-6779pdf-en-US-504217.pdf
CVE: CVE-2025-8108
Published: 2025-11-11
Description: An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732, CWE-1287
References: https://www.axis.com/dam/public/38/20/aa/cve-2025-8108pdf-en-US-504218.pdf
CVE: CVE-2025-10714
Published: 2025-11-11
Description: AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating system. This vulnerability can only be exploited if the attacker has access to the local Windows machine and sufficient access rights (administrator) to write data into the installation path of AXIS Optimizer.
CVSS Score: 8.4 (HIGH)
CWE: CWE-428
References: https://www.axis.com/dam/public/a2/c7/8c/cve-2025-10714pdf-en-US-504221.pdf
CVE: CVE-2025-5317
Published: 2025-11-11
Description: An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the application directory (/Applications/Endpoint Security for Mac.app/) and the related directories within /Library/Bitdefender/AVP without needing the uninstall password.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://www.bitdefender.com/support/security-advisories/improper-access-restriction-to-critical-folder-in-bitdefender-endpoint-security-tools-for-mac/
CVE: CVE-2025-7429
Published: 2025-11-11
Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7429.html
CVE: CVE-2025-8998
Published: 2025-11-11
Description: It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account.
CVSS Score: 3.1 (LOW)
CWE: CWE-73
References: https://www.axis.com/dam/public/f5/62/80/cve-2025-8998pdf-en-US-504374.pdf
CVE: CVE-2025-9055
Published: 2025-11-11
Description: The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating with an administrator-privileged service account.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-250
References: https://www.axis.com/dam/public/23/a3/00/cve-2025-9055pdf-en-US-504219.pdf
CVE: CVE-2025-9524
Published: 2025-11-11
Description: The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1287
References: https://www.axis.com/dam/public/f1/f0/1e/cve-2025-9524pdf-en-US-504220.pdf
CVE: CVE-2017-20210
Published: 2025-11-11
Description: Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://www.qnap.com/en-in/security-advisory/nas-201705-04
CVE: CVE-2025-12539
Published: 2025-11-11
Description: The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-922
References: https://github.com/The-Network-Crew/TNC-Toolbox-for-WordPress/commit/31bb3040b22c84e2d6dfd3210fe0ad045ff4ddf6; https://www.wordfence.com/threat-intel/vulnerabilities/id/2eaa5a5c-c11f-40d0-be69-c3ec8029a819?source=cve
CVE: CVE-2025-12787
Published: 2025-11-11
Description: The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhb_meeting_form_submit_callback" function using insufficiently random values to generate booking cancellation tokens, combined with a globally shared nonce. This makes it possible for unauthenticated attackers to cancel arbitrary bookings via brute force attacks against the tfhb_meeting_form_cencel AJAX endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-330
References: https://plugins.trac.wordpress.org/changeset/3392864/hydra-booking/tags/1.1.28/app/Shortcode/HydraBookingShortcode.php?old=3392467&old_path=hydra-booking%2Ftags%2F1.1.27%2Fapp%2FShortcode%2FHydraBookingShortcode.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/490dd84f-7c03-43c7-b4e1-167fa2b15c03?source=cve
CVE: CVE-2025-12788
Published: 2025-11-11
Description: The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-602
References: https://plugins.trac.wordpress.org/changeset/3392864/hydra-booking/tags/1.1.28/app/Shortcode/HydraBookingShortcode.php?old=3392467&old_path=hydra-booking%2Ftags%2F1.1.27%2Fapp%2FShortcode%2FHydraBookingShortcode.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b49ce4a2-52ad-4824-86fc-5edd2e33802d?source=cve
CVE: CVE-2025-12846
Published: 2025-11-11
Description: The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a valid SVG file. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset/3391933/blocksy-companion/trunk/framework/features/svg.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/f8615422-5db7-495d-9956-7d6f658f42bf?source=cve
CVE: CVE-2025-12953
Published: 2025-11-11
Description: The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "rtcl_ajax_add_listing_type", "rtcl_ajax_update_listing_type", and "rtcl_ajax_delete_listing_type" function in all versions up to, and including, 5.2.0. This makes it possible for authenticated attackers, with subscriber level access and above, to add, update, or delete listing types.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3389342/classified-listing/trunk/app/Controllers/Ajax/AjaxListingType.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/811f147e-5829-4f7e-91d8-9dba780950d5?source=cve
CVE: CVE-2025-7430
Published: 2025-11-11
Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7430.html
CVE: CVE-2025-7632
Published: 2025-11-11
Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7632.html
CVE: CVE-2025-7633
Published: 2025-11-11
Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7633.html
CVE: CVE-2025-11960
Published: 2025-11-11
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc. KVKNET allows Reflected XSS.This issue affects KVKNET: before 2.1.8.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0386
CVE: CVE-2025-41101
Published: 2025-11-11
Description: HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in'/projects/save'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fairsketchs-rise-crm-framework