deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0995
Published: 2025-02-15
Description: Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_12.html; https://issues.chromium.org/issues/391907159
CVE: CVE-2025-0996
Published: 2025-02-15
Description: Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1007
References: https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_12.html; https://issues.chromium.org/issues/391788835
CVE: CVE-2025-0997
Published: 2025-02-15
Description: Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_12.html; https://issues.chromium.org/issues/391666328
CVE: CVE-2025-0998
Published: 2025-02-15
Description: Rejected reason: Not exploitable
CVE: CVE-2025-1302
Published: 2025-02-15
Description: Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.**Note:**This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456; https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127; https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee
CVE: CVE-2024-13208
Published: 2025-02-15
Description: The Maps Plugin using Google Maps for WordPress  WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f86d4f64-208f-407f-8d2c-a89b5e0ac777/
CVE: CVE-2024-13306
Published: 2025-02-15
Description: The Maps Plugin using Google Maps for WordPress  WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ec3096f2-60fd-4654-9e95-5cf4b20b2990/
CVE: CVE-2024-13513
Published: 2025-02-15
Description: The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's clientToken, which in turn can be used to change user account information including emails and account type. This allows attackers to then change account passwords resulting in a complete site takeover. Version 2.4.2.3 disabled logging but left sites with existing log files vulnerable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/models/class-pos-bridge-user.php#L373; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3234731%40oliver-pos%2Ftrunk&old=3056051%40oliver-pos%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/bf6b7d8d-fb13-4eb4-b0b4-d0a10ad2a21e?source=cve
CVE: CVE-2024-13525
Published: 2025-02-15
Description: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via Shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including emails as well as hashed passwords of any user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.9.2/includes/class-alg-wc-ev-core.php#L990; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3232261%40emails-verification-for-woocommerce%2Ftrunk&old=3230854%40emails-verification-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a63a41d1-b9b0-43a9-a6e0-761f3b8d9d4a?source=cve
CVE: CVE-2024-13563
Published: 2025-02-15
Description: The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all versions up to, and including, 3.2.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/front-end-only-users/trunk/Shortcodes/Insert_Forgot_Password.php#L61; https://plugins.trac.wordpress.org/changeset/3240349/; https://wordpress.org/plugins/front-end-only-users
CVE: CVE-2025-0935
Published: 2025-02-15
Description: The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to change plugin settings related to things such as IP-blocking.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L6296; https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L697; https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L7198
CVE: CVE-2025-22208
Published: 2025-02-15
Description: A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22208; https://joomsky.com/js-jobs-joomla/
CVE: CVE-2025-22209
Published: 2025-02-15
Description: A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22209; https://joomsky.com/js-jobs-joomla/
CVE: CVE-2024-12562
Published: 2025-02-15
Description: The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the 's2member_pro_remote_op' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://s2member.com/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/65192fdb-86db-475a-8c61-4db922920cfe?source=cve
CVE: CVE-2024-13752
Published: 2025-02-15
Description: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cause a persistent denial of service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/core/Upgrades/Upgrade_2_0.php#L255; https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/core/Upgrades/Upgrade_2_3.php#L151; https://plugins.trac.wordpress.org/changeset/3239348/
CVE: CVE-2025-1005
Published: 2025-02-15
Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion widget in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/elementskit-lite/trunk/modules/layout-manager/assets/js/ekit-layout-library.js; https://plugins.trac.wordpress.org/changeset?old_path=%2Felementskit-lite&old=3230214&new_path=%2Felementskit-lite&new=3237243&sfp_email=&sfph_mail=; https://wordpress.org/plugins/elementskit-lite/#developers
CVE: CVE-2024-10581
Published: 2025-02-15
Description: The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missing or incorrect nonce validation on the dpfl_listingStatusChange() function. This makes it possible for unauthenticated attackers to update listing statuses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3239657%40directorypress-frontend&new=3239657%40directorypress-frontend&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/36986585-7aaa-4c49-b426-fb9078fbb9ae?source=cve
CVE: CVE-2024-13439
Published: 2025-02-15
Description: The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function in all versions up to, and including, 4.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.svn.wordpress.org/tlp-team/tags/4.4.7/app/Controllers/Admin/Ajax/Settings.php; https://plugins.trac.wordpress.org/changeset/3239948/tlp-team/trunk/app/Controllers/Admin/Ajax/Settings.php; https://plugins.trac.wordpress.org/changeset/3239948/tlp-team/trunk/app/Controllers/Admin/Ajax/Skill.php
CVE: CVE-2024-13488
Published: 2025-02-15
Description: The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to, and including, 3.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-estes-edition/trunk/warehouse-dropship/wild/includes/wild-delivery-save.php#L250; https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-estes-edition/trunk/warehouse-dropship/wild/includes/wild-delivery-save.php#L364; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3239967%40ltl-freight-quotes-estes-edition&new=3239967%40ltl-freight-quotes-estes-edition&sfp_email=&sfph_mail=
CVE: CVE-2024-13500
Published: 2025-02-15
Description: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/3239348/; https://wordpress.org/plugins/wedevs-project-manager/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/70083f93-f110-4029-a3d3-ce8a77799a31?source=cve
CVE: CVE-2025-0822
Published: 2025-02-15
Description: Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://plugins.trac.wordpress.org/browser/bit-assist/tags/1.5.2/backend/app/HTTP/Controllers/DownloadController.php#L65; https://plugins.trac.wordpress.org/changeset/3239816/#file3; https://wordpress.org/plugins/bit-assist/#developers
CVE: CVE-2024-13834
Published: 2025-02-15
Description: The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remote_request' function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/changeset/3240422/responsive-add-ons; https://www.wordfence.com/threat-intel/vulnerabilities/id/b2833265-f1e5-4cfd-ad2f-ca28a59de82f?source=cve
CVE: CVE-2025-26793
Published: 2025-02-15
Description: The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the "vulnerable systems are not following manufacturers' recommendations to change the default password."
CWE: CWE-1393
References: https://news.ycombinator.com/item?id=43160884; https://support.identiv.com/products/physical-access/hirsch/; https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes/
CVE: CVE-2025-1332
Published: 2025-02-16
Description: A vulnerability has been found in FastCMS up to 0.1.5 and classified as problematic. This vulnerability affects unknown code of the file /fastcms.html#/template/menu of the component Template Menu. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/xjd2020/fastcms/issues/IBKJ1W; https://vuldb.com/?ctiid.295942; https://vuldb.com/?id.295942
CVE: CVE-2024-57970
Published: 2025-02-16
Description: libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-126
References: https://github.com/libarchive/libarchive/issues/2415; https://github.com/libarchive/libarchive/pull/2422
CVE: CVE-2024-57971
Published: 2025-02-16
Description: DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-99
References: https://github.com/KnowageLabs/Knowage-Server/commit/f7d0362f737e1b0db1cc9cc95b1236d62d83dd0c; https://github.com/KnowageLabs/Knowage-Server/compare/v8.1.29...v8.1.30; https://github.com/darumaseye/CVEs/blob/ec2de9f7ecffde466e687745bfdfc672e86241d7/CVE-2024-57971.md
CVE: CVE-2025-1335
Published: 2025-02-16
Description: A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimg_action in the library lib/admin/file_admin.php. The manipulation of the argument imgname leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Sinon2003/cve/blob/main/CmsEasy/CmsEasy-v7.7.7.9-PathTraversal-2-2-1.md; https://vuldb.com/?ctiid.295950; https://vuldb.com/?id.295950
CVE: CVE-2025-1336
Published: 2025-02-16
Description: A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimg_action in the library lib/admin/image_admin.php. The manipulation of the argument imgname leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Sinon2003/cve/blob/main/CmsEasy/CmsEasy-v7.7.7.9-PathTraversal-2-2-2.md; https://vuldb.com/?ctiid.295951; https://vuldb.com/?id.295951
CVE: CVE-2025-1337
Published: 2025-02-16
Description: A vulnerability was found in Eastnets PaymentSafe 2.5.26.0. It has been classified as problematic. This affects an unknown part of the component BIC Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.5.27.0 is able to address this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://drive.google.com/file/d/1uTRLoCnOGcXtSpoZO8xyPakhIO4MbCMk/view?usp=sharing; https://vuldb.com/?ctiid.295953; https://vuldb.com/?id.295953
CVE: CVE-2025-1338
Published: 2025-02-16
Description: A vulnerability was found in NUUO Camera up to 20250203. It has been declared as critical. This vulnerability affects the function print_file of the file /handle_config.php. The manipulation of the argument log leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-77
References: https://pan.baidu.com/s/1YW52iM0ehUfFKa_CiTHBjQ?from=init&pwd=kqec; https://vuldb.com/?ctiid.295954; https://vuldb.com/?id.295954
CVE: CVE-2025-1339
Published: 2025-02-16
Description: A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/stevenchen0x01/CVE2/blob/main/cve1.md; https://vuldb.com/?ctiid.295955; https://vuldb.com/?id.295955
CVE: CVE-2025-1340
Published: 2025-02-16
Description: A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/stevenchen0x01/CVE2/blob/main/stack_overflow.md; https://vuldb.com/?ctiid.295956; https://vuldb.com/?id.295956
CVE: CVE-2025-1341
Published: 2025-02-16
Description: A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. This affects an unknown part of the component Setting Handler. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-521
References: https://mega.nz/file/yY0BnAgK#08RcRH8c8D4zMhKLEqQwMenHV65lnHsOSuV4eQkdcxY; https://vuldb.com/?ctiid.295959; https://vuldb.com/?id.295959
CVE: CVE-2025-1352
Published: 2025-02-16
Description: A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: https://sourceware.org/bugzilla/attachment.cgi?id=15923; https://sourceware.org/bugzilla/show_bug.cgi?id=32650; https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2
CVE: CVE-2025-1353
Published: 2025-02-16
Description: A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical. This issue affects some unknown processing in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The real existence of this vulnerability is still doubted at the moment. The vendor is not able to reproduce the issue.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426
References: https://vuldb.com/?ctiid.295961; https://vuldb.com/?id.295961; https://vuldb.com/?submit.496010