deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-60179
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Space Studio Click & Tweet allows Stored XSS. This issue affects Click & Tweet: from n/a through 0.8.9.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/click-tweet/vulnerability/wordpress-click-tweet-plugin-0-8-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60181
Published: 2025-09-26
Description: Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Silencesoft RSS Reader: from n/a through <= 0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/external-rss-reader/vulnerability/wordpress-silencesoft-rss-reader-plugin-0-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-60184
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. SEO Search Permalink seo-search-permalink allows Stored XSS.This issue affects SEO Search Permalink: from n/a through <= 1.0.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/seo-search-permalink/vulnerability/wordpress-seo-search-permalink-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60185
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kontur.us kontur Admin Style kontur-admin-style allows Stored XSS.This issue affects kontur Admin Style: from n/a through <= 1.0.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kontur-admin-style/vulnerability/wordpress-kontur-admin-style-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60186
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Google+ Comments google-plus-comments allows Stored XSS.This issue affects Google+ Comments: from n/a through <= 1.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/google-plus-comments/vulnerability/wordpress-google-comments-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60219
Published: 2025-09-26
Description: Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro wc-designer-pro allows Upload a Web Shell to a Web Server.This issue affects WooCommerce Designer Pro: from n/a through <= 1.9.24.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wc-designer-pro/vulnerability/wordpress-woocommerce-designer-pro-plugin-1-9-24-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-7691
Published: 2025-09-26
Description: A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 that could have allowed a developer with specific group management permissions to escalate their privileges and obtain unauthorized access to additional system capabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-267
References: https://gitlab.com/gitlab-org/gitlab/-/issues/555786; https://hackerone.com/reports/3200469
CVE: CVE-2025-9642
Published: 2025-09-26
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/566505; https://hackerone.com/reports/3297413
CVE: CVE-2025-9958
Published: 2025-09-26
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations.
CVSS Score: 7.7 (HIGH)
CWE: CWE-201
References: https://gitlab.com/gitlab-org/gitlab/-/issues/567777; https://hackerone.com/reports/3323573
CVE: CVE-2025-10544
Published: 2025-09-26
Description: Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files that compromise the system. In addition, it is vulnerable to Path Traversal, which allows files to be written to arbitrary directories within the web root.
CWE: CWE-434
References: https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-uploading-dangerous-file-types-avepoint-products
CVE: CVE-2025-10868
Published: 2025-09-26
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string conversion methods exhibit performance degradation with large inputs.
CVSS Score: 3.5 (LOW)
CWE: CWE-840
References: https://gitlab.com/gitlab-org/gitlab/-/issues/526482
CVE: CVE-2025-11042
Published: 2025-09-26
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while using specific GraphQL queries.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/550374
CVE: CVE-2025-5069
Published: 2025-09-26
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project.
CVSS Score: 3.5 (LOW)
CWE: CWE-708
References: https://gitlab.com/gitlab-org/gitlab/-/issues/544926; https://hackerone.com/reports/3019236
CVE: CVE-2025-11010
Published: 2025-09-26
Description: A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_include_common of the file /src/ucl_util.c. Such manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/user-attachments/files/22317650/poc.zip; https://github.com/vstakhov/libucl/issues/337; https://vuldb.com/?ctiid.325953
CVE: CVE-2025-11011
Published: 2025-09-26
Description: A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_export.cpp. Performing manipulation of the argument Source results in null pointer dereference. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d. It is suggested to install a patch to address this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476, CWE-476
References: https://github.com/BehaviorTree/BehaviorTree.CPP/commit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d; https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1008; https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1009
CVE: CVE-2025-11012
Published: 2025-09-26
Description: A vulnerability was determined in BehaviorTree up to 4.7.0. This affects the function ParseScript of the file /src/script_parser.cpp of the component Diagnostic Message Handler. Executing manipulation of the argument error_msgs_buffer can lead to stack-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. This patch is called cb6c7514efa628adb8180b58b4c9ccdebbe096e3. A patch should be applied to remediate this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121
References: https://github.com/BehaviorTree/BehaviorTree.CPP/commit/cb6c7514efa628adb8180b58b4c9ccdebbe096e3; https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1006; https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1007
CVE: CVE-2025-11013
Published: 2025-09-26
Description: A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xml_parsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit is publicly available and might be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476, CWE-476
References: https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1003; https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1004; https://github.com/user-attachments/files/22245915/poc.zip
CVE: CVE-2025-11014
Published: 2025-09-26
Description: A security flaw has been discovered in OGRECave Ogre up to 14.4.1. This issue affects the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp of the component Image Handler. The manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/OGRECave/ogre/issues/3445; https://github.com/user-attachments/files/22326665/poc.zip; https://vuldb.com/?ctiid.325957
CVE: CVE-2025-11025
Published: 2025-09-26
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform allows Retrieve Embedded Sensitive Data.This issue affects Vimesoft Corporate Messaging Platform: from V1.3.0 before V2.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://www.usom.gov.tr/bildirim/tr-25-0300
CVE: CVE-2025-11060
Published: 2025-09-26
Description: A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-863
References: https://access.redhat.com/security/cve/CVE-2025-11060; https://bugzilla.redhat.com/show_bug.cgi?id=2394708; https://github.com/surrealdb/surrealdb
CVE: CVE-2025-9267
Published: 2025-09-26
Description: In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current working directory without validating their origin or integrity. This behavior can be exploited by placing a malicious DLL in the same directory as the installer executable, leading to arbitrary code execution with the privileges of the user running the installer. The issue stems from the use of insecure DLL loading practices, such as relying on relative paths or failing to specify fully qualified paths when invoking system libraries.
CWE: CWE-426, CWE-427
References: https://www.seagate.com/product-security/#security-advisories; https://www.seagate.com/support/software/toolkit/; https://github.com/Tiger3080/CVE-2025-9267
CVE: CVE-2025-11015
Published: 2025-09-26
Description: A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory management routines. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-762
References: https://github.com/OGRECave/ogre/issues/3446; https://github.com/user-attachments/files/22328216/poc.zip; https://vuldb.com/?ctiid.325958
CVE: CVE-2025-11016
Published: 2025-09-26
Description: A security vulnerability has been detected in kalcaddle kodbox up to 1.61.09. The affected element is the function fileOut of the file app/controller/explorer/index.class.php. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/August829/YU1/issues/3; https://github.com/August829/YU1/issues/3#issue[PII_REDACTED]; https://vuldb.com/?ctiid.325959
CVE: CVE-2025-11017
Published: 2025-09-26
Description: A vulnerability was detected in OGRECave Ogre up to 14.4.1. The impacted element is the function Ogre::LogManager::stream of the file /ogre/OgreMain/src/OgreLogManager.cpp. Performing manipulation of the argument mDefaultLog results in null pointer dereference. The attack must be initiated from a local position. The exploit is now public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476, CWE-476
References: https://github.com/OGRECave/ogre/issues/3447; https://github.com/user-attachments/files/22335685/poc.zip; https://vuldb.com/?ctiid.325960
CVE: CVE-2025-11018
Published: 2025-09-26
Description: A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Executing manipulation of the argument fileName can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/MMarch7/CVE/issues/1; https://vuldb.com/?ctiid.325961; https://vuldb.com/?id.325961
CVE: CVE-2025-11019
Published: 2025-09-26
Description: A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.325962; https://vuldb.com/?id.325962; https://vuldb.com/?submit.651427
CVE: CVE-2025-11026
Published: 2025-09-26
Description: A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Configuration File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."
CVSS Score: 3.5 (LOW)
CWE: CWE-200, CWE-284
References: https://gist.github.com/KhanMarshaI/14b48f974cbdaa3278a81a169e4caae1; https://vuldb.com/?ctiid.325964; https://vuldb.com/?id.325964
CVE: CVE-2025-36274
Published: 2025-09-26
Description: IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://www.ibm.com/support/pages/node/7246284
CVE: CVE-2025-36326
Published: 2025-09-26
Description: IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies.
CVSS Score: 3.7 (LOW)
CWE: CWE-321
References: https://www.ibm.com/support/pages/node/7246015
CVE: CVE-2025-55187
Published: 2025-09-26
Description: In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269
References: https://drivelock.help/versions/2025_1/web/en/releasenotes/Content/ReleaseNotes_DriveLock/NewRelease/Aenderungen_Patch2.htm; https://drivelock.help/versions/2025_1/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-001-RemotePriviledge.htm; https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-001-RemotePriviledge.htm
CVE: CVE-2025-57292
Published: 2025-09-26
Description: Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ASencerK/TodoistStoredXSS; https://github.com/echoBRT/TodoistStoredXSS; https://github.com/echoBRT/TodoistStoredXSS
CVE: CVE-2025-6396
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webbeyaz Website Design Website Software allows Cross-Site Scripting (XSS).This issue affects Website Software: through 2025.07.14.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0302
CVE: CVE-2025-11027
Published: 2025-09-26
Description: A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gist.github.com/KhanMarshaI/b90045ee823866a52f33615776b5a6ec; https://vuldb.com/?ctiid.325965; https://vuldb.com/?id.325965
CVE: CVE-2025-11028
Published: 2025-09-26
Description: A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the component Image Handler. Performing manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://gist.github.com/KhanMarshaI/9a1a5b72ff7a0a9d180ca77d26814bc7; https://vuldb.com/?ctiid.325966; https://vuldb.com/?id.325966
CVE: CVE-2025-56463
Published: 2025-09-26
Description: Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/MatJosephs/CVEs/tree/main/CVE-2025-56463; https://packetstormsecurity.com
CVE: CVE-2025-58385
Published: 2025-09-26
Description: In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data).
CVSS Score: 7.1 (HIGH)
CWE: CWE-798
References: https://doc.doxense.com/Watchdoc/J_Securite/cve-2025-58385.htm; https://update.doxense.com/
CVE: CVE-2025-59362
Published: 2025-09-26
Description: Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-121
References: https://github.com/Microsvuln/advisories/blob/main/CVE-2025-59362/CVE-2025-59362.md; https://github.com/squid-cache/squid/pull/2149
CVE: CVE-2025-59842
Published: 2025-09-26
Description: jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue has been patched in version 4.4.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1022
References: https://github.com/jupyterlab/jupyterlab/commit/88ef373039a8cc09f27d3814382a512d9033675c; https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vvfj-2jqx-52jm
CVE: CVE-2025-59843
Published: 2025-09-26
Description: Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.2 or later to eliminate exposure. There are no workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-359
References: https://github.com/FlagForgeCTF/flagForge/commit/1b033f1b6e20fbf6df422d5d1afc9b2347528ace; https://github.com/FlagForgeCTF/flagForge/compare/v2.3.1...v2.3.2; https://github.com/FlagForgeCTF/flagForge/releases/tag/v2.3.1
CVE: CVE-2025-11029
Published: 2025-09-26
Description: A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://gist.github.com/KhanMarshaI/165ae8f63ec6b5fdf1f[PII_REDACTED]fce; https://gist.github.com/KhanMarshaI/db888b65cfd75bead2035348babfb423; https://vuldb.com/?ctiid.325967
CVE: CVE-2025-11030
Published: 2025-09-26
Description: A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of the file /admin/all-applied-leave.php of the component HTTP Request Handler. The manipulation results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-285
References: https://drive.google.com/file/d/1N5ApKiYw-yKNhVERr4m3ruooiANgpFRo/view?usp=sharing; https://vuldb.com/?ctiid.325969; https://vuldb.com/?id.325969