deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2525
Published: 2025-04-08
Description: The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'st_Authentication_Controller::edit_profile' function in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://documentation.iqonic.design/streamit/change-log/streamit-v4-0/; https://themeforest.net/item/streamit-video-streaming-wordpress-theme/29772881; https://www.wordfence.com/threat-intel/vulnerabilities/id/83a58119-d0ed-47fe-93d1-1aa1def2cf44?source=cve
CVE: CVE-2025-2526
Published: 2025-04-08
Description: The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email in the 'st_Authentication_Controller::edit_profile' function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://documentation.iqonic.design/streamit/change-log/streamit-v4-0/; https://themeforest.net/item/streamit-video-streaming-wordpress-theme/29772881; https://www.wordfence.com/threat-intel/vulnerabilities/id/057abffb-1c52-49ca-8791-ca44f0c5a011?source=cve
CVE: CVE-2025-3361
Published: 2025-04-08
Description: The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.twcert.org.tw/en/lp-139-2.html; https://www.twcert.org.tw/tw/cp-132-10051-76634-1.html
CVE: CVE-2025-3362
Published: 2025-04-08
Description: The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-10055-7dacf-2.html; https://www.twcert.org.tw/tw/cp-132-10053-890b1-1.html
CVE: CVE-2025-3363
Published: 2025-04-08
Description: The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-10056-c553a-2.html; https://www.twcert.org.tw/tw/cp-132-10054-84588-1.html
CVE: CVE-2025-3392
Published: 2025-04-08
Description: A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this issue is the function Save of the file cn/gson/oasys/controller/mail/MailController.java of the component Backend. The manipulation of the argument MailNumberId leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/hailey888/oa_system/issues/IBRQZ9; https://vuldb.com/?ctiid.303638; https://vuldb.com/?id.303638
CVE: CVE-2025-3393
Published: 2025-04-08
Description: A vulnerability was found in mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef[PII_REDACTED]3509. It has been classified as problematic. This affects an unknown part of the file /ucan-admin/index of the component Personal Settings Interface. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://gitee.com/mrcen/springboot-ucan-admin/issues/IBT2W5; https://vuldb.com/?ctiid.303639; https://vuldb.com/?id.303639
CVE: CVE-2025-3397
Published: 2025-04-08
Description: A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argument gourl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.303642; https://vuldb.com/?id.303642; https://vuldb.com/?submit.525203
CVE: CVE-2025-3398
Published: 2025-04-08
Description: A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/src/main/java/org/sang/config/WebSecurityConfig.java. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://magnificent-dill-351.notion.site/Improper-Authentication-Vulnerability-in-VBlog-1-0-0-1c0c693918ed80f2ace4fff7d1d51619; https://vuldb.com/?ctiid.303643; https://vuldb.com/?id.303643
CVE: CVE-2025-3399
Published: 2025-04-08
Description: A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5.6.3.154.205_20250114. Affected by this issue is some unknown functionality of the file /pubinfo/updateNotice.jsp. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Rain1er/report/blob/main/CDG/MTA%3D.md; https://vuldb.com/?ctiid.303644; https://vuldb.com/?id.303644
CVE: CVE-2025-3400
Published: 2025-04-08
Description: A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. This affects an unknown part of the file /client/UnChkMailApplication.jsp. The manipulation of the argument typename leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Rain1er/report/blob/main/CDG/NA%3D%3D.md; https://vuldb.com/?ctiid.303645; https://vuldb.com/?id.303645
CVE: CVE-2025-32413
Published: 2025-04-08
Description: Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/vulnerability-lookup/vulnerability-lookup/commit/0a120af1de4a0a13bc2e2000f3c[PII_REDACTED]ba0; https://github.com/vulnerability-lookup/vulnerability-lookup/compare/v2.7.0...v2.7.1
CVE: CVE-2025-32414
Published: 2025-04-08
Description: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-393, CWE-252
References: https://gitlab.gnome.org/GNOME/libxml2/-/issues/889; https://lists.debian.org/debian-lts-announce/2025/04/msg00041.html; https://gitlab.gnome.org/GNOME/libxml2/-/issues/889
CVE: CVE-2025-3364
Published: 2025-04-08
Description: The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access the entire file system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-250
References: https://www.twcert.org.tw/en/cp-139-10058-fce0b-2.html; https://www.twcert.org.tw/tw/cp-132-10057-58c05-1.html
CVE: CVE-2025-3401
Published: 2025-04-08
Description: A vulnerability has been found in ESAFENET CDG 5.6.3.154.205_20250114 and classified as critical. This vulnerability affects unknown code of the file /parameter/getLimitIPList.jsp. The manipulation of the argument noticeId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Rain1er/report/blob/main/CDG/Ng%3D%3D.md; https://vuldb.com/?ctiid.303646; https://vuldb.com/?id.303646
CVE: CVE-2025-3402
Published: 2025-04-08
Description: A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform 5.5.2 and classified as critical. This issue affects some unknown processing of the file /sysform/042/check.js%70. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Angel12345623/CVE/blob/main/CVE_1.md; https://vuldb.com/?ctiid.303647; https://vuldb.com/?id.303647
CVE: CVE-2025-3403
Published: 2025-04-08
Description: A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.7 (LOW)
CWE: CWE-200, CWE-540
References: https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md; https://vuldb.com/?ctiid.303648; https://vuldb.com/?id.303648
CVE: CVE-2025-3405
Published: 2025-04-08
Description: A vulnerability was found in FCJ Venture Builder appclientefiel 3.0.27. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /rest/cliente/ObterPedido/ of the component HTTP GET Request Handler. The manipulation of the argument ORDER_ID leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-99
References: https://drive.google.com/file/d/1yhZiKFX0avpLDsYDlbnmmkTk4XTY8Y2h/view; https://vuldb.com/?ctiid.303649; https://vuldb.com/?id.303649
CVE: CVE-2025-3406
Published: 2025-04-08
Description: A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-of-bounds read. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://vuldb.com/?ctiid.303684; https://vuldb.com/?id.303684; https://vuldb.com/?submit.544226
CVE: CVE-2025-3407
Published: 2025-04-08
Description: A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_from_image. The manipulation of the argument h_count/v_count leads to out-of-bounds read. The attack can be launched remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://vuldb.com/?ctiid.303685; https://vuldb.com/?id.303685; https://vuldb.com/?submit.544227
CVE: CVE-2025-3408
Published: 2025-04-08
Description: A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-189, CWE-190
References: https://vuldb.com/?ctiid.303686; https://vuldb.com/?id.303686; https://vuldb.com/?submit.544230
CVE: CVE-2024-13820
Published: 2025-04-08
Description: The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, which uses a hardcoded hash. This makes it possible for unauthenticated attackers to extract sensitive data including environment information, plugin tokens, shipping configurations, and limited vendor information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/melhorenvio/wp-melhorenvio-v2/blob/6e2f5bb01c536df9fc84534eb8a27ec99d9601af/Services/TestService.php; https://plugins.trac.wordpress.org/browser/melhor-envio-cotacao/trunk/Services/TestService.php#L20; https://plugins.trac.wordpress.org/browser/melhor-envio-cotacao/trunk/Services/TestService.php#L30
CVE: CVE-2025-20934
Published: 2025-04-08
Description: Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilege.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-926
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20935
Published: 2025-04-08
Description: Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access files with system privilege. User interaction is required for triggering this vulnerability.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20936
Published: 2025-04-08
Description: Improper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers with shell privilege to escalate their privileges to root.
CVSS Score: 8.8 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20938
Published: 2025-04-08
Description: Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to access protected data in SamsungContacts.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20939
Published: 2025-04-08
Description: Improper authorization in wireless download protocol in Galaxy Watch prior to SMR Apr-2025 Release 1 allows physical attackers to update device unique identifier of Watch devices.
CVSS Score: 5.4 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20940
Published: 2025-04-08
Description: Improper handling of insufficient permission in Samsung Device Health Manager Service prior to SMR Apr-2025 Release 1 allows local attackers to access provider in SDMHS.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20941
Published: 2025-04-08
Description: Improper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to access the scancode of specific input device.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20942
Published: 2025-04-08
Description: Improper Verification of Intent by Broadcast Receiver in DeviceIdService prior to SMR Apr-2025 Release 1 allows local attackers to reset OAID.
CVSS Score: 4.4 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20943
Published: 2025-04-08
Description: Out-of-bounds write in secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to cause memory corruption.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20944
Published: 2025-04-08
Description: Out-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows local attackers to read out-of-bounds memory.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20945
Published: 2025-04-08
Description: Improper access control in Galaxy Watch prior to SMR Apr-2025 Release 1 allows local attackers to access sensitive information of Galaxy watch.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-922
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20946
Published: 2025-04-08
Description: Improper handling of exceptional conditions in pairing specific bluetooth devices in Galaxy Watch Bluetooth pairing prior to SMR Apr-2025 Release 1 allows local attackers to pair with specific bluetooth devices without user interaction.
CVSS Score: 8.8 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20947
Published: 2025-04-08
Description: Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access image files across multiple users. User interaction is required for triggering this vulnerability.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20948
Published: 2025-04-08
Description: Out-of-bounds read in enrollment with cdsp frame secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04
CVE: CVE-2025-20950
Published: 2025-04-08
Description: Use of implicit intent for sensitive communication in SamsungNotes prior to version 4.4.26.45 allows local attackers to access sensitive information.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=04
CVE: CVE-2025-20951
Published: 2025-04-08
Description: Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.90.7 allows local attackers to write arbitrary files with the privilege of Galaxy Store.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=04
CVE: CVE-2025-2004
Published: 2025-04-08
Description: The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpe_delete_file AJAX action in all versions up to, and including, 1.8.17. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE-2025-32509 is a duplicate of this.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/browser/simple-wp-events/trunk/admin/includes/wp-events-export-events.php#L399; https://plugins.trac.wordpress.org/changeset/3280966/simple-wp-events/trunk/admin/includes/wp-events-export-events.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/abdca93e-f68d-4a96-8bd7-443ee46ccb5a?source=cve
CVE: CVE-2025-3409
Published: 2025-04-08
Description: A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipulation of the argument path_to_includes leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-121
References: https://vuldb.com/?ctiid.303687; https://vuldb.com/?id.303687; https://vuldb.com/?submit.544231
CVE: CVE-2025-3410
Published: 2025-04-08
Description: A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file training_platform/train-platform/src/main/java/top/aias/training/controller/LocalStorageController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/Tr0e/CVE_Hunter/blob/main/AIAS/AIAS_RCE.md; https://vuldb.com/?ctiid.303688; https://vuldb.com/?id.303688
CVE: CVE-2025-3411
Published: 2025-04-08
Description: A vulnerability, which was classified as critical, has been found in mymagicpower AIAS 20250308. This issue affects some unknown processing of the file 3_api_platform/api-platform/src/main/java/top/aias/platform/controller/AsrController.java. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/Tr0e/CVE_Hunter/blob/main/AIAS/AIAS_SSRF1.md; https://vuldb.com/?ctiid.303689; https://vuldb.com/?id.303689
CVE: CVE-2024-47261
Published: 2025-04-08
Description: 51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an attacker to upload files to block access to create image overlays in the web interface of the Axis device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1287
References: https://www.axis.com/dam/public/18/c5/b2/cve-2024-47261pdf-en-US-474505.pdf
CVE: CVE-2025-0361
Published: 2025-04-08
Description: During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: https://www.axis.com/dam/public/f4/9b/13/cve-2025-0361pdf-en-US-474511.pdf
CVE: CVE-2025-3412
Published: 2025-04-08
Description: A vulnerability, which was classified as critical, was found in mymagicpower AIAS 20250308. Affected is an unknown function of the file 2_training_platform/train-platform/src/main/java/top/aias/training/controller/InferController.java. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/Tr0e/CVE_Hunter/blob/main/AIAS/AIAS_SSRF2.md; https://vuldb.com/?ctiid.303690; https://vuldb.com/?id.303690