deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2390
Published: 2023-04-28
Description: A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ntp.server1 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227668. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/10; https://vuldb.com/?ctiid.227668; https://vuldb.com/?id.227668
CVE: CVE-2023-29057
Published: 2023-04-28
Description: A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-118321; https://support.lenovo.com/us/en/product_security/LEN-118321
CVE: CVE-2023-29058
Published: 2023-04-28
Description: A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-118321; https://support.lenovo.com/us/en/product_security/LEN-118321
CVE: CVE-2023-2391
Published: 2023-04-28
Description: A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This issue affects some unknown processing of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ntp.server2 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227669 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/11; https://vuldb.com/?ctiid.227669; https://vuldb.com/?id.227669
CVE: CVE-2023-2392
Published: 2023-04-28
Description: A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. Affected is an unknown function of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ManualDate.minutes leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/12; https://vuldb.com/?ctiid.227670; https://vuldb.com/?id.227670
CVE: CVE-2023-2393
Published: 2023-04-28
Description: A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument ConfigPort.LogicalIfName leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/13; https://vuldb.com/?ctiid.227671; https://vuldb.com/?id.227671
CVE: CVE-2023-2394
Published: 2023-04-28
Description: A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation of the argument wanName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227672. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/14; https://vuldb.com/?ctiid.227672; https://vuldb.com/?id.227672
CVE: CVE-2023-30405
Published: 2023-04-28
Description: A cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the wl_ssid parameter at /boafrm/formHomeWlanSetup.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/172057/Aigital-Wireless-N-Repeater-Mini_Router.0.131229-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/172057/Aigital-Wireless-N-Repeater-Mini_Router.0.131229-Cross-Site-Scripting.html
CVE: CVE-2023-30857
Published: 2023-04-28
Description: @aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.

CVSS Score: 3.7 (LOW)
CWE: CWE-1321
References: https://github.com/aedart/ion/commit/c3e2ee08710d4164d796ecb66ed291335dae9291; https://github.com/aedart/ion/security/advisories/GHSA-wwxh-74fx-33c6; https://github.com/aedart/ion/commit/c3e2ee08710d4164d796ecb66ed291335dae9291
CVE: CVE-2023-30858
Published: 2023-04-28
Description: The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload. The issue has been patched in 0.3.0. As a workaround, avoid using the `replace`, `unemojify`, or `strip` functions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/denosaurs/emoji/pull/11; https://github.com/denosaurs/emoji/security/advisories/GHSA-w2xx-hjhp-gx5v; https://huntr.dev/bounties/444f2255-5085-466f-ba0e-5549fa8846a3/
CVE: CVE-2023-31444
Published: 2023-04-28
Description: In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. This allows for remote access to the JVM via the Jolokia JMX-HTTP bridge.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://talend.com; https://www.talend.com/security/incident-response/#CVE-2023-31444; https://talend.com
CVE: CVE-2023-31470
Published: 2023-04-28
Description: SmartDNS through 41 before 56d0332 allows an out-of-bounds write because of a stack-based buffer overflow in the _dns_encode_domain function in the dns.c file, via a crafted DNS request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/pymumu/smartdns/commit/56d0332bf91104cfc877635f6c82e9348587df04; https://github.com/pymumu/smartdns/issues/1378; https://github.com/pymumu/smartdns/commit/56d0332bf91104cfc877635f6c82e9348587df04
CVE: CVE-2023-24269
Published: 2023-04-28
Description: An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/s4n-h4xor/CVE-Publications/blob/main/CVE-2023-24269/CVE-2023-24269.md; https://github.com/s4n-h4xor/CVE-Publications/blob/main/CVE-2023-24269/CVE-2023-24269.md
CVE: CVE-2023-25495
Published: 2023-04-28
Description: A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations.  There is no exposure where no LDAP client password is configured
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://support.lenovo.com/us/en/product_security/LEN-99936; https://support.lenovo.com/us/en/product_security/LEN-99936
CVE: CVE-2023-25496
Published: 2023-04-28
Description: A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://iknow.lenovo.com.cn/detail/dc_415202.html; https://iknow.lenovo.com.cn/detail/dc_415202.html
CVE: CVE-2023-29056
Published: 2023-04-28
Description: A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://support.lenovo.com/us/en/product_security/LEN-118321; https://support.lenovo.com/us/en/product_security/LEN-118321
CVE: CVE-2023-2395
Published: 2023-04-28
Description: A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the component Web Management Interface. The manipulation of the argument Login.userAgent leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227673 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/15; https://vuldb.com/?ctiid.227673; https://vuldb.com/?id.227673
CVE: CVE-2023-2396
Published: 2023-04-28
Description: A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3. This vulnerability affects unknown code of the component Web Management Interface. The manipulation of the argument USERDBUsers.Password leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227674 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/16; https://vuldb.com/?ctiid.227674; https://vuldb.com/?id.227674
CVE: CVE-2023-2397
Published: 2023-04-28
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Mobile Comparison Website 1.0. This issue affects some unknown processing of the file classes/Master.php?f=save_field. The manipulation of the argument Field Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227675.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/sunyucheng0405/bug_report/blob/main/XSS-1.md; https://vuldb.com/?ctiid.227675; https://vuldb.com/?id.227675
CVE: CVE-2023-2408
Published: 2023-04-28
Description: A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. Affected by this issue is some unknown functionality of the file services/view.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227702 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-1.pdf; https://vuldb.com/?ctiid.227702; https://vuldb.com/?id.227702
CVE: CVE-2023-2409
Published: 2023-04-28
Description: A vulnerability, which was classified as critical, was found in SourceCodester AC Repair and Services System 1.0. This affects an unknown part of the file /admin/services/view_service.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227703.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-2.pdf; https://vuldb.com/?ctiid.227703; https://vuldb.com/?id.227703
CVE: CVE-2023-2410
Published: 2023-04-28
Description: A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/bookings/view_booking.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227704.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-3.pdf; https://vuldb.com/?ctiid.227704; https://vuldb.com/?id.227704
CVE: CVE-2023-2411
Published: 2023-04-28
Description: A vulnerability was found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227705 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-4.pdf; https://vuldb.com/?ctiid.227705; https://vuldb.com/?id.227705
CVE: CVE-2023-31483
Published: 2023-04-28
Description: tar/TarFileReader.cpp in Cauldron cbang before bastet-v8.1.17 has a directory traversal during extraction that allows the attacker to create or write to files outside the current directory via a crafted tar archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/CauldronDevelopmentLLC/cbang/compare/bastet-v8.1.16...bastet-v8.1.17; https://github.com/CauldronDevelopmentLLC/cbang/issues/115; https://github.com/CauldronDevelopmentLLC/cbang/compare/bastet-v8.1.16...bastet-v8.1.17
CVE: CVE-2023-2412
Published: 2023-04-29
Description: A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227706 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-5.pdf; https://vuldb.com/?ctiid.227706; https://vuldb.com/?id.227706
CVE: CVE-2023-2413
Published: 2023-04-29
Description: A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/bookings/manage_booking.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227707.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-6.pdf; https://vuldb.com/?ctiid.227707; https://vuldb.com/?id.227707
CVE: CVE-2023-31484
Published: 2023-04-29
Description: CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: http://www.openwall.com/lists/oss-security/2023/04/29/1; http://www.openwall.com/lists/oss-security/2023/05/03/3; http://www.openwall.com/lists/oss-security/2023/05/03/5
CVE: CVE-2023-31485
Published: 2023-04-29
Description: GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://www.openwall.com/lists/oss-security/2023/04/29/1; http://www.openwall.com/lists/oss-security/2023/05/03/3; http://www.openwall.com/lists/oss-security/2023/05/03/5
CVE: CVE-2023-31486
Published: 2023-04-29
Description: HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: http://www.openwall.com/lists/oss-security/2023/04/29/1; http://www.openwall.com/lists/oss-security/2023/05/03/3; http://www.openwall.com/lists/oss-security/2023/05/03/5
CVE: CVE-2023-2417
Published: 2023-04-29
Description: A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic. Affected by this issue is some unknown functionality of the file C:\Program Files (x86)\HostMonitor\RMA-Win\rma_active.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. Upgrading to version 12.60 is able to address this issue. It is recommended to upgrade the affected component. VDB-227714 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-428
References: http://packetstormsecurity.com/files/172105/Advanced-Host-Monitor-12.56-Unquoted-Service-Path.html; https://vuldb.com/?ctiid.227714; https://vuldb.com/?id.227714
CVE: CVE-2023-2418
Published: 2023-04-29
Description: A vulnerability was found in Konga 2.8.3 on Kong. It has been classified as problematic. This affects an unknown part of the component Login API. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The associated identifier of this vulnerability is VDB-227715.
CVSS Score: 3.1 (LOW)
CWE: CWE-330
References: https://vuldb.com/?ctiid.227715; https://vuldb.com/?id.227715; https://www.cnblogs.com/andao/p/17330864.html
CVE: CVE-2023-2419
Published: 2023-04-29
Description: A vulnerability was found in Zhong Bang CRMEB 4.6.0. It has been declared as critical. This vulnerability affects the function videoUpload of the file \crmeb\app\services\system\attachment\SystemAttachmentServices.php. The manipulation of the argument filename leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227716.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/crmeb/CRMEB/issues/77; https://vuldb.com/?ctiid.227716; https://vuldb.com/?id.227716
CVE: CVE-2023-2420
Published: 2023-04-29
Description: A vulnerability was found in MLECMS 3.0. It has been rated as critical. This issue affects the function get_url in the library /upload/inc/lib/admin of the file upload\inc\include\common.func.php. The manipulation of the argument $_SERVER['REQUEST_URI'] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227717 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/VG00000/elecms/blob/main/README.md; https://vuldb.com/?ctiid.227717; https://vuldb.com/?id.227717
CVE: CVE-2023-2421
Published: 2023-04-29
Description: A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2/#/add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.227718; https://vuldb.com/?id.227718; https://youtu.be/4JOLhAuoizE
CVE: CVE-2022-41736
Published: 2023-04-29
Description: IBM Spectrum Scale Container Native Storage Access 

5.1.2.1 through 5.1.6.0

contains an unspecified vulnerability that could allow a local user to obtain root privileges.  IBM X-Force ID:  237810.
CVSS Score: 8.4 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/237810; https://www.ibm.com/support/pages/node/6964564; https://exchange.xforce.ibmcloud.com/vulnerabilities/237810
CVE: CVE-2022-43871
Published: 2023-04-29
Description: IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  239707.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239707; https://www.ibm.com/support/pages/node/6857799; https://exchange.xforce.ibmcloud.com/vulnerabilities/239707
CVE: CVE-2023-30792
Published: 2023-04-29
Description: Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/facebook/lexical/releases/tag/v0.10.0; https://github.com/facebook/lexical/releases/tag/v0.10.0
CVE: CVE-2023-2424
Published: 2023-04-29
Description: A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the file uploads/dede/config.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227750 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://gitee.com/xieqiangweb/cve/blob/master/dede/dedecms%20rce.md; https://vuldb.com/?ctiid.227750; https://vuldb.com/?id.227750
CVE: CVE-2023-2425
Published: 2023-04-29
Description: A vulnerability was found in SourceCodester Simple Student Information System 1.0. It has been classified as problematic. This affects an unknown part of the file /classes/Master.php?f=save_course of the component Add New Course. The manipulation of the argument name with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227751.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/sssddc11/bug_report/blob/master/XSS-1.md; https://vuldb.com/?ctiid.227751; https://vuldb.com/?id.227751