deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8340
Published: 2025-07-31
Description: A vulnerability was found in code-projects Intern Membership Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file fill_details.php of the component Error Message Handler. The manipulation of the argument email leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/shenxianyuguitian/intern-mms-vuln-XSS/blob/main/README.md; https://vuldb.com/?ctiid.318292
CVE: CVE-2025-8343
Published: 2025-07-31
Description: A vulnerability was found in openviglet shio up to 0.3.8. It has been rated as critical. This issue affects the function shStaticFilePreUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument fileName leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/openviglet/shio/issues/1028; https://github.com/openviglet/shio/issues/1028#issue[PII_REDACTED]; https://vuldb.com/?ctiid.318293
CVE: CVE-2025-8344
Published: 2025-07-31
Description: A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument filename leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/openviglet/shio/issues/1029; https://github.com/openviglet/shio/issues/1029#issue[PII_REDACTED]; https://vuldb.com/?ctiid.318294
CVE: CVE-2025-8345
Published: 2025-07-31
Description: A vulnerability classified as critical was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this vulnerability is the function delete_user of the file crm/WeiXinApp/yunzhijia/yunzhijiaApi.php. The manipulation of the argument function leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.6.5.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/jackyliu666/blob01/blob/main/README.md; https://vuldb.com/?ctiid.318295; https://vuldb.com/?id.318295
CVE: CVE-2025-8346
Published: 2025-07-31
Description: A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /educar_aluno_lst.php. The manipulation of the argument ref_cod_matricula with the input "><img%20src=x%20onerror=alert(%27CVE-Hunters%27)> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/CVE-Hunters/CVE/blob/main/i-educar/CVE-2025-8346.md; https://vuldb.com/?ctiid.318296; https://vuldb.com/?id.318296
CVE: CVE-2025-8347
Published: 2025-07-31
Description: A vulnerability, which was classified as critical, was found in Kehua Charging Pile Cloud Platform 1.0. This affects an unknown part of the file /sys/task/findAllTask. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qiantx/cve/blob/main/CVE2.md; https://vuldb.com/?ctiid.318297; https://vuldb.com/?id.318297
CVE: CVE-2025-8348
Published: 2025-07-31
Description: A vulnerability has been found in Kehua Charging Pile Cloud Platform 1.0 and classified as critical. This vulnerability affects unknown code of the file /home. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/qiantx/cve/blob/main/cve3.md; https://vuldb.com/?ctiid.318298; https://vuldb.com/?id.318298
CVE: CVE-2025-8365
Published: 2025-07-31
Description: A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file atendidos_cad.php. The manipulation of the argument nome/nome_social/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/CVE-Hunters/CVE/blob/main/i-educar/Stored%20Cross-Site%20Scripting%20XSS%20in%20atendidos_cad.php%20via%20nome%2C%20nome_social%2C%20and%20email%20Parameters.md; https://vuldb.com/?ctiid.318337; https://vuldb.com/?id.318337
CVE: CVE-2025-5720
Published: 2025-07-31
Description: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all versions up to, and including, 5.80.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.78.1/includes/reviews/class-cr-reviews-list-table.php#L1033; https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.78.1/includes/reviews/class-cr-reviews-list-table.php#L1052; https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.78.1/includes/reviews/class-cr-reviews-list-table.php#L1073
CVE: CVE-2025-7847
Published: 2025-07-31
Description: The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server when the REST API is enabled, which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.3/classes/api.php#L673; https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.3/classes/modules/files.php#L332; https://plugins.trac.wordpress.org/changeset/3329842/ai-engine/trunk/classes/api.php
CVE: CVE-2025-8366
Published: 2025-07-31
Description: A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_lst.php. The manipulation of the argument nome/matricula_servidor leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8366.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XSS%20educar_servidor_lst.php%20parameters%20nome%20and%20matricula_servidor.md; https://vuldb.com/?ctiid.318338
CVE: CVE-2025-8367
Published: 2025-07-31
Description: A vulnerability classified as problematic has been found in Portabilis i-Educar 2.9. This affects an unknown part of the file /intranet/funcionario_vinculo_lst.php. The manipulation of the argument nome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8367.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XSS%20funcionario_vinculo_lst.php%20parameter%20nome.md; https://vuldb.com/?ctiid.318339
CVE: CVE-2025-53558
Published: 2025-07-31
Description: ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1391
References: https://jvn.jp/en/jp/JVN66546573/
CVE: CVE-2025-8368
Published: 2025-07-31
Description: A vulnerability classified as problematic was found in Portabilis i-Educar 2.9. This vulnerability affects unknown code of the file /intranet/pesquisa_pessoa_lst.php. The manipulation of the argument campo_busca/cpf leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8368.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XSS%20intranet.pesquisa_pessoa_lst.php_parameters_campo_busca_and_cpf.md; https://vuldb.com/?ctiid.318340
CVE: CVE-2025-8369
Published: 2025-07-31
Description: A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9. This issue affects some unknown processing of the file /intranet/educar_avaliacao_desempenho_lst.php. The manipulation of the argument titulo_avaliacao leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8369.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XXS%20educar_avaliacao_desempenho_lst.md; https://vuldb.com/?ctiid.318341
CVE: CVE-2025-8370
Published: 2025-07-31
Description: A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9. Affected is an unknown function of the file /intranet/educar_escolaridade_lst.php. The manipulation of the argument descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8370.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XXS%20educar_escolaridade_lst.md; https://vuldb.com/?ctiid.318342
CVE: CVE-2025-8371
Published: 2025-07-31
Description: A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/update_s5.php. The manipulation of the argument credits leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/mynlxx/CVE-ZhuChengQing/issues/1; https://vuldb.com/?ctiid.318343
CVE: CVE-2025-36563
Published: 2025-07-31
Description: Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script may be executed on the browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/vu/JVNVU93412964/; https://www.powercms.jp/news/release-powercms-671-531-461.html
CVE: CVE-2025-41391
Published: 2025-07-31
Description: Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be executed on the browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/vu/JVNVU93412964/; https://www.powercms.jp/news/release-powercms-671-531-461.html
CVE: CVE-2025-41396
Published: 2025-07-31
Description: A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/vu/JVNVU93412964/; https://www.powercms.jp/news/release-powercms-671-531-461.html
CVE: CVE-2025-46359
Published: 2025-07-31
Description: A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/vu/JVNVU93412964/; https://www.powercms.jp/news/release-powercms-671-531-461.html
CVE: CVE-2025-54752
Published: 2025-07-31
Description: Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file.  If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1236
References: https://jvn.jp/en/vu/JVNVU93412964/; https://www.powercms.jp/news/release-powercms-671-531-461.html
CVE: CVE-2025-54757
Published: 2025-07-31
Description: Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an arbitrary script may be executed on the browser.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://jvn.jp/en/vu/JVNVU93412964/; https://www.powercms.jp/news/release-powercms-671-531-461.html
CVE: CVE-2025-7205
Published: 2025-07-31
Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with GiveWP worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additionally, they need to trick an administrator into visiting the legacy version of the site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/give/trunk/src/API/REST/V3/Routes/Donors/DonorNotesController.php#51; https://plugins.trac.wordpress.org/changeset/3333090/give; https://www.wordfence.com/threat-intel/vulnerabilities/id/39e501d8-88a0-4625-aeb0-aa33fc89a8d4?source=cve
CVE: CVE-2025-8372
Published: 2025-07-31
Description: A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/update_s7.php. The manipulation of the argument credits leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/mynlxx/CVE-ZhuChengQing/issues/2; https://vuldb.com/?ctiid.318344
CVE: CVE-2025-8373
Published: 2025-07-31
Description: A vulnerability was found in code-projects Vehicle Management 1.0. It has been classified as critical. This affects an unknown part of the file /print.php. The manipulation of the argument sno leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/7; https://vuldb.com/?ctiid.318345
CVE: CVE-2025-24853
Published: 2025-07-31
Description: A carefully crafted request when creating a header link using the 
wiki markup syntax, which could allow the attacker to execute javascript
 in the victim's browser and get some sensitive information about the 
victim.



Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.

Apache JSPWiki users should upgrade to 2.12.3 or later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24853; http://www.openwall.com/lists/oss-security/2025/07/30/2
CVE: CVE-2025-24854
Published: 2025-07-31
Description: A carefully crafted request using the Image plugin could trigger an XSS 
vulnerability on Apache JSPWiki, which could allow the attacker to 
execute javascript in the victim's browser and get some sensitive 
information about the victim.





Apache JSPWiki users should upgrade to 2.12.3 or later.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24854; http://www.openwall.com/lists/oss-security/2025/07/30/3
CVE: CVE-2025-8192
Published: 2025-07-31
Description: There exists a TOCTOU race condition in TvSettings AppRestrictionsFragment.java that lead to start of attacker supplied activity in Settings’ context, i.e. system-uid context, thus lead to launchAnyWhere. The core idea is to utilize the time window between the check of Intent and the use to Intent to change the target component’s state, thus bypass the original security sanitize function.
CWE: CWE-367
References: https://defcon.org/html/defcon-33/dc-33-speakers.html#content_60309
CVE: CVE-2025-8374
Published: 2025-07-31
Description: A vulnerability was found in code-projects Vehicle Management 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /addcompany.php. The manipulation of the argument company leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/6; https://vuldb.com/?ctiid.318346
CVE: CVE-2025-8375
Published: 2025-07-31
Description: A vulnerability was found in code-projects Vehicle Management 1.0. It has been rated as critical. This issue affects some unknown processing of the file /addvehicle.php. The manipulation of the argument vehicle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/5; https://vuldb.com/?ctiid.318347
CVE: CVE-2025-2813
Published: 2025-07-31
Description: An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://certvde.com/en/advisories/VDE-2025-029/
CVE: CVE-2025-40980
Published: 2025-07-31
Description: A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products/<PRODUCT_ID>/edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her session cookies details.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-ultimatepos
CVE: CVE-2025-41688
Published: 2025-07-31
Description: A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.
CVSS Score: 7.2 (HIGH)
CWE: CWE-653
References: https://certvde.com/de/advisories/VDE-2025-065; https://certvde.com/de/advisories/VDE-2025-069
CVE: CVE-2025-8376
Published: 2025-07-31
Description: A vulnerability classified as critical has been found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /updatebal.php. The manipulation of the argument company leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/4; https://vuldb.com/?ctiid.318348
CVE: CVE-2025-8378
Published: 2025-07-31
Description: A vulnerability was found in Campcodes Online Hotel Reservation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/XiaoJiesecqwq/sql/issues/1; https://vuldb.com/?ctiid.318356; https://vuldb.com/?id.318356
CVE: CVE-2025-8379
Published: 2025-07-31
Description: A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/edit_room.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/XiaoJiesecqwq/sql/issues/2; https://vuldb.com/?ctiid.318357; https://vuldb.com/?id.318357
CVE: CVE-2025-8380
Published: 2025-07-31
Description: A vulnerability classified as problematic was found in Campcodes Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/add_query_account.php. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/XiaoJiesecqwq/sql/issues/3; https://vuldb.com/?ctiid.318358; https://vuldb.com/?id.318358
CVE: CVE-2025-8068
Published: 2025-07-31
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an improper capability check on the 'ajax_trash_templates' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary attachment files, and move arbitrary posts, pages, and templates to the Trash.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.9.0/admin/include/class.theme-builder.php#L625; https://plugins.trac.wordpress.org/changeset/3336533/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d9cf6dae-572f-4eaa-8e8a-bca9e74fe738?source=cve
CVE: CVE-2025-8151
Published: 2025-07-31
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_block_css' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any directory, and delete CSS files in any directory in a Windows environment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.9.1/htmega-blocks/includes/classes/Manage_Styles.php#L118; https://plugins.trac.wordpress.org/changeset/3336533/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6b3e93bf-af5c-4ca3-a531-2d91df880c51?source=cve