deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-29834
Published: 2025-04-12
Description: Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29834
CVE: CVE-2025-32726
Published: 2025-04-12
Description: Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32726
CVE: CVE-2025-2841
Published: 2025-04-12
Description: The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/cart66-cloud/tags/2.3.7/views/admin/html-system-info.php#L26; https://plugins.trac.wordpress.org/browser/cart66-cloud/tags/2.3.7/views/admin/html-system-info.php#L39; https://plugins.trac.wordpress.org/browser/cart66-cloud/tags/2.3.7/views/admin/html-system-info.php#L59
CVE: CVE-2025-2881
Published: 2025-04-12
Description: The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/developer-toolbar/trunk/views/phpinfo.php#L45; https://wordpress.org/plugins/developer-toolbar/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/e10ba37a-cd7d-4fc9-8b41-806fa3dc7785?source=cve
CVE: CVE-2025-2871
Published: 2025-04-12
Description: The WordPress Mega Menu – QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the ajax_dismiss_notice() function. This makes it possible for unauthenticated attackers to update any user meta to a value of one, including wp_capabilities which could result in a privilege deescalation of an administrator, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/quadmenu/tags/3.2.0/lib/class-admin.php#L105; https://plugins.trac.wordpress.org/changeset/3270825/quadmenu/tags/3.2.1/lib/class-admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba7b675-54d6-4f0e-b60f-1c7fa6ff24ea?source=cve
CVE: CVE-2024-13337
Published: 2025-04-12
Description: The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.2. This is due to missing or incorrect nonce validation on the 'setup-wbcr_clearfy' page. This makes it possible for unauthenticated attackers to update the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.dev/WordPressPluginDirectory/clearfy; https://plugins.trac.wordpress.org/changeset/3268278/clearfy/trunk/libs/factory/templates/pages/setup-parts/class-step-form.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f21dbe-f300-4336-9980-a69d40395f39?source=cve
CVE: CVE-2024-13338
Published: 2025-04-12
Description: The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the wclearfy_cache_delete functionality . This makes it possible for unauthenticated attackers to clear the cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3268278/clearfy/trunk/components/cache/includes/cache.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a37ce4-9860-415e-bb88-545c30c95fc1?source=cve
CVE: CVE-2025-3276
Published: 2025-04-12
Description: The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3267889%40skt-blocks&new=3267889%40skt-blocks&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d9345eaa-c8c0-4830-a9af-48305a2f80fd?source=cve
CVE: CVE-2025-3282
Published: 2025-04-12
Description: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member() due to missing validation on the 'membership_id' user controlled key. This makes it possible for unauthenticated attackers to update any user's membership to any other active or non-active membership type.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset/3268617/user-registration/trunk/modules/membership/includes/AJAX.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/c525b41c-dca5-442a-927e-4583cb303ed1?source=cve
CVE: CVE-2025-3292
Published: 2025-04-12
Description: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to update other user's passwords, if they have access to the user ID and email.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/user-registration/tags/4.1.3/includes/class-ur-ajax.php#L323; https://plugins.trac.wordpress.org/changeset/3268617/user-registration/trunk/includes/class-ur-ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/59a63cd8-9d33-4a2c-a499-5b1ee38c07d6?source=cve
CVE: CVE-2025-3418
Published: 2025-04-12
Description: The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajax_edit_save() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/changeset/3269302/wpc-admin-columns/trunk/includes/class-backend.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6145e2d7-c917-4814-a13e-6d34088cb784?source=cve
CVE: CVE-2025-1455
Published: 2025-04-12
Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/woo-grid/widgets/wpr-woo-grid.php#L9280; https://plugins.trac.wordpress.org/changeset/3262790/royal-elementor-addons/tags/1.7.1013/modules/woo-grid/widgets/wpr-woo-grid.php?old=3255849&old_path=royal-elementor-addons%2Ftags%2F1.7.1012%2Fmodules%2Fwoo-grid%2Fwidgets%2Fwpr-woo-grid.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/5666e2b7-acb3-4abb-ac2a[PII_REDACTED]cf?source=cve
CVE: CVE-2025-1456
Published: 2025-04-12
Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/assets/js/frontend.min.js; https://plugins.trac.wordpress.org/changeset/3262790/royal-elementor-addons/tags/1.7.1013/assets/js/frontend.js?old=3255849&old_path=royal-elementor-addons%2Ftags%2F1.7.1012%2Fassets%2Fjs%2Ffrontend.js; https://www.wordfence.com/threat-intel/vulnerabilities/id/68c6e428-b9cf-442f-a896-a8ceb4b9be0e?source=cve
CVE: CVE-2025-2814
Published: 2025-04-13
Description: Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

This issue affects operating systems where "/dev/urandom'" is unavailable.  In that case, Crypt::CBC will fallback to use the insecure rand() function.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-329, CWE-331, CWE-338, CWE-338
References: https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch; https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777; https://perldoc.perl.org/functions/rand
CVE: CVE-2025-3531
Published: 2025-04-13
Description: A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/zonesec0/findcve/issues/4; https://github.com/zonesec0/findcve/issues/5; https://vuldb.com/?ctiid.304569
CVE: CVE-2025-3532
Published: 2025-04-13
Description: A vulnerability classified as problematic was found in YouDianCMS 9.5.21. This vulnerability affects unknown code of the file /App/Tpl/Member/Default/Order/index.html.Attackers. The manipulation of the argument OrderNumber leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/zonesec0/findcve/issues/6; https://vuldb.com/?ctiid.304570; https://vuldb.com/?id.304570
CVE: CVE-2025-3533
Published: 2025-04-13
Description: A vulnerability, which was classified as problematic, has been found in YouDianCMS 9.5.21. This issue affects some unknown processing of the file /App/Tpl/Admin/Default/Channel/index.html.Attackers. The manipulation of the argument Parent leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/zonesec0/findcve/issues/7; https://vuldb.com/?ctiid.304571; https://vuldb.com/?id.304571
CVE: CVE-2025-3534
Published: 2025-04-13
Description: A vulnerability, which was classified as critical, was found in PowerCreator CMS 1.0. Affected is an unknown function of the file /OpenPublicCourse.aspx. The manipulation of the argument cid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/yztale/powercreator/blob/main/README.md; https://vuldb.com/?ctiid.304572; https://vuldb.com/?id.304572
CVE: CVE-2025-3535
Published: 2025-04-13
Description: A vulnerability has been found in shuanx BurpAPIFinder up to 2.0.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file BurpApiFinder.db. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/shuanx/BurpAPIFinder/issues/18; https://github.com/shuanx/BurpAPIFinder/issues/18#issue[PII_REDACTED]; https://vuldb.com/?ctiid.304573
CVE: CVE-2025-3423
Published: 2025-04-13
Description: IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7230757
CVE: CVE-2025-3536
Published: 2025-04-13
Description: A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete-user.php. The manipulation of the argument ID leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266, CWE-285, CWE-639
References: https://vuldb.com/?ctiid.304574; https://vuldb.com/?id.304574; https://vuldb.com/?submit.545810
CVE: CVE-2025-3537
Published: 2025-04-13
Description: A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/update-user.php. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-285, CWE-639
References: https://vuldb.com/?ctiid.304575; https://vuldb.com/?id.304575; https://vuldb.com/?submit.545859
CVE: CVE-2024-56406
Published: 2025-04-13
Description: A heap buffer overflow vulnerability was discovered in Perl. 

Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.

When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.

   $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' 
   Segmentation fault (core dumped)

It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
CVSS Score: 8.4 (HIGH)
CWE: CWE-122, CWE-787, CWE-787
References: https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch; https://metacpan.org/release/SHAY/perl-5.38.4/changes; https://metacpan.org/release/SHAY/perl-5.40.2/changes
CVE: CVE-2025-3538
Published: 2025-04-13
Description: A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function auth_asp of the file /auth.asp of the component jhttpd. The manipulation of the argument callback leads to stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/Fizz-L/CVE1/blob/main/DI-8100Command%20execution2.md; https://vuldb.com/?ctiid.304577; https://vuldb.com/?id.304577
CVE: CVE-2025-3445
Published: 2025-04-13
Description: A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library.

When using the archiver.Unarchive functionality with ZIP files, like this: archiver.Unarchive(zipFile, outputDir),  A crafted ZIP file can be extracted in such a way that it writes files to the affected system with the same privileges as the application executing this vulnerable functionality. Consequently, sensitive files may be overwritten, potentially leading to privilege escalation, code execution, and other severe outcomes in some cases.

It's worth noting that a similar vulnerability was found in TAR files (CVE-2024-0406). Although a fix was implemented, it hasn't been officially released, and the affected project has since been deprecated. The successor to mholt/archiver is a new project called mholt/archives, and its initial release (v0.1.0) removes the Unarchive() functionality.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://github.com/mholt/archiver/
CVE: CVE-2025-3539
Published: 2025-04-13
Description: A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getBasicInfo of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/isstabber/my_VulnHub/blob/main/h3cNX15/nx15_command_injection.md; https://vuldb.com/?ctiid.304578; https://vuldb.com/?id.304578
CVE: CVE-2025-3540
Published: 2025-04-13
Description: A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGI_WizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://gist.github.com/mono7s/882650a9a9b54bedc374caf8308efef2; https://vuldb.com/?ctiid.304579; https://vuldb.com/?id.304579
CVE: CVE-2025-3541
Published: 2025-04-13
Description: A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this issue is the function FCGI_WizardProtoProcess of the file /api/wizard/getSpecs of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://gist.github.com/mono7s/fcbc1f02d69547704cc9027b29e51c73; https://vuldb.com/?ctiid.304580; https://vuldb.com/?id.304580
CVE: CVE-2025-3542
Published: 2025-04-14
Description: A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the function FCGI_WizardProtoProcess of the file /api/wizard/getsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://gist.github.com/mono7s/dd7a0a1ec444bb2c228590d298e37a5d; https://vuldb.com/?ctiid.304581; https://vuldb.com/?id.304581
CVE: CVE-2025-3543
Published: 2025-04-14
Description: A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. This vulnerability affects the function FCGI_WizardProtoProcess of the file /api/wizard/setsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://gist.github.com/mono7s/9369a3ef060b5655303cd234ba583bb5; https://vuldb.com/?ctiid.304582; https://vuldb.com/?id.304582
CVE: CVE-2025-3544
Published: 2025-04-14
Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getCapabilityWeb of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://gist.github.com/isstabber/05dfeefa3685a369b8802626e0252e27; https://vuldb.com/?ctiid.304583; https://vuldb.com/?id.304583
CVE: CVE-2025-3545
Published: 2025-04-14
Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/setLanguage of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://gist.github.com/isstabber/cc7bc3281c0f0d6659d2f9934e1c57c1; https://vuldb.com/?ctiid.304584; https://vuldb.com/?id.304584
CVE: CVE-2025-3546
Published: 2025-04-14
Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getLanguage of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://gist.github.com/isstabber/154661f329e4ae6bfe15dcdc0b932ff3; https://vuldb.com/?ctiid.304585; https://vuldb.com/?id.304585