deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54460
Published: 2025-08-21
Description: The vulnerability, if exploited, could allow an authenticated miscreant 
(with privileges to create or access publication targets of type Text 
File or HDFS) to upload and persist files that could potentially be 
executed.
CVSS Score: 7.1 (HIGH)
CWE: CWE-434
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04
CVE: CVE-2025-55103
Published: 2025-08-21
Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/2925891-2
CVE: CVE-2025-55104
Published: 2025-08-21
Description: A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS payload. If this stored XSS payload is triggered by any user attacker supplied JavaScript may execute in the victim's browser.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/2925891-2
CVE: CVE-2025-55105
Published: 2025-08-21
Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/2925891-2
CVE: CVE-2025-55106
Published: 2025-08-21
Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/2925891-2
CVE: CVE-2025-55107
Published: 2025-08-21
Description: There is a stored
  Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites
  versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to
  inject malicious a file with an embedded xss script which when loaded could
  potentially execute arbitrary JavaScript code in the victim’s browser. The
  privileges required to execute this attack are high. The attack could
  disclose a privileged token which may result in the attacker gaining full
  control of the Portal.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/2925891-2
CVE: CVE-2025-55229
Published: 2025-08-21
Description: Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55229
CVE: CVE-2025-55230
Published: 2025-08-21
Description: Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55230
CVE: CVE-2025-55231
Published: 2025-08-21
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an unauthorized attacker to execute code over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55231
CVE: CVE-2009-20002
Published: 2025-08-21
Description: Millenium MP3 Studio versions up to and including 2.0 is vulnerable to a stack-based buffer overflow when parsing .pls playlist files. The application fails to properly validate the length of the File1 field within the playlist, allowing an attacker to craft a malicious .pls file that overwrites the Structured Exception Handler (SEH) and executes arbitrary code. Exploitation requires the victim to open the file locally, though remote execution may be possible if the .pls extension is registered to the application and opened via a browser.
CWE: CWE-121
References: https://ccm.net/downloads/sound/5995-millennium-mp3-studio/; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/millenium_mp3_pls.rb; https://web.archive.org/web/[PII_REDACTED]2010/http://www.milw0rm.com/exploits/9277
CVE: CVE-2009-20003
Published: 2025-08-21
Description: Xenorate versions up to and including 2.50, a Windows-based multimedia player, is vulnerable to a stack-based buffer overflow when processing .xpl playlist files. The application fails to properly validate the length of input data, allowing an attacker to craft a malicious .xpl file that overwrites the Structured Exception Handler (SEH) and enables arbitrary code execution. Exploitation requires local interaction, typically by convincing a user to open the crafted file.
CWE: CWE-121
References: http://www.xenorate.com/; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/xenorate_xpl_bof.rb; https://web.archive.org/web/[PII_REDACTED]1109/http://www.xenorate.com/
CVE: CVE-2009-20004
Published: 2025-08-21
Description: gAlan 0.2.1, a modular audio processing environment for Windows, is vulnerable to a stack-based buffer overflow when parsing .galan files. The application fails to properly validate the length of input data, allowing a specially crafted file to overwrite the stack and execute arbitrary code. Exploitation requires local interaction, typically by convincing a user to open the malicious file.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/galan_fileformat_bof.rb; https://web.archive.org/web/[PII_REDACTED]5252/http://galan.sourceforge.net/; https://www.exploit-db.com/exploits/10339
CVE: CVE-2010-20007
Published: 2025-08-21
Description: Seagull FTP Client <= v3.3 Build 409 contains a stack-based buffer overflow vulnerability in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessively long filename, the application fails to properly validate input length, resulting in a buffer overflow that overwrites the Structured Exception Handler (SEH). This may allow remote attackers to execute arbitrary code on the client system. This product line was discontinued and users were advised to use BlueZone Secure FTP instead, at the time of disclosure.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/seagull_list_reply.rb; https://web.archive.org/web/[PII_REDACTED]4057/https://www.corelan.be/index.php/2010/10/12/death-of-an-ftp-client/; https://web.archive.org/web/[PII_REDACTED]4617/http://bluezone.rocketsoftware.com/products/secure-managed-file-transfer/bz-secure-ftp/at-a-glance
CVE: CVE-2010-20034
Published: 2025-08-21
Description: Gekko Manager FTP Client <= 0.77 contains a stack-based buffer overflow in its FTP directory listing parser. When processing a server response to a LIST command, the client fails to properly validate the length of filenames. A crafted response containing an overly long filename can overwrite the Structured Exception Handler (SEH), potentially allowing remote code execution.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/gekkomgr_list_reply.rb; https://web.archive.org/web/[PII_REDACTED]4057/https://www.corelan.be/index.php/2010/10/12/death-of-an-ftp-client/; https://www.exploit-db.com/exploits/16728
CVE: CVE-2010-20107
Published: 2025-08-21
Description: A stack-based buffer overflow exists in FTP Synchronizer Professional <= v4.0.73.274. When the client connects to an FTP server and issues a LIST command—typically during sync preview or profile creation—the server’s response containing an overly long filename triggers a buffer overflow. This results in the corruption of the Structured Exception Handler (SEH), potentially allowing remote code execution.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/ftpsynch_list_reply.rb; https://web.archive.org/web/[PII_REDACTED]4057/https://www.corelan.be/index.php/2010/10/12/death-of-an-ftp-client/; https://web.archive.org/web/[PII_REDACTED]5434/http://www.ftpsynchronizer.com/
CVE: CVE-2010-20108
Published: 2025-08-21
Description: FTPPad <= 1.2.0 contains a stack-based buffer overflow vulnerability in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessively long directory and filename, the application fails to properly validate input length. This results in a buffer overflow that overwrites the saved Extended Instruction Pointer (EIP), allowing remote attackers to execute arbitrary code.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/ftppad_list_reply.rb; https://web.archive.org/web/[PII_REDACTED]4057/https://www.corelan.be/index.php/2010/10/12/death-of-an-ftp-client/; https://www.chip.de/downloads/FTPPad_12993921.html
CVE: CVE-2010-20113
Published: 2025-08-21
Description: EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface. When processing a GET request to list.html, the server fails to properly validate the length of the path parameter. Supplying an excessively long value causes a buffer overflow on the stack, potentially corrupting control flow structures. The vulnerability is exposed through the embedded web server and does not require authentication due to default anonymous access. The issue was resolved in version 1.7.0.12, after which the product was renamed to UplusFtp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/easyftp_list.rb; https://www.exploit-db.com/exploits/11500; https://www.vulncheck.com/advisories/easyftp-server-list-html-stack-buffer-overflow
CVE: CVE-2010-20114
Published: 2025-08-21
Description: VariCAD EN up to and including version 2010-2.05 is vulnerable to a stack-based buffer overflow when parsing .dwb drawing files. The application fails to properly validate the length of input data embedded in the file, allowing a crafted .dwb file to overwrite critical memory structures. This flaw can be exploited locally by convincing a user to open a malicious file, resulting in arbitrary code execution.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/varicad_dwb.rb; https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=26522; https://www.exploit-db.com/exploits/11789
CVE: CVE-2010-20115
Published: 2025-08-21
Description: Arcane Software’s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.
CWE: CWE-704, CWE-787
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/vermillion_ftpd_port.rb; https://web.archive.org/web/[PII_REDACTED]2028/http://www.softsea.com/review/Vermillion-FTP-Daemon.html; https://web.archive.org/web/[PII_REDACTED]0657/http://www.global-evolution.info/news/files/vftpd/vftpd.txt
CVE: CVE-2010-20120
Published: 2025-08-21
Description: Maple versions up to and including 13's Maplet framework allows embedded commands to be executed automatically when a .maplet file is opened. This behavior bypasses standard security restrictions that normally prevent code execution in regular Maple worksheets. The vulnerability enables attackers to craft malicious .maplet files that execute arbitrary code without user interaction.
CWE: CWE-94
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/fileformat/maple_maplet.rb; https://www.exploit-db.com/exploits/16308; https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:MISC:MAPLE-MAPLET-CMD-EXEC.html
CVE: CVE-2010-20122
Published: 2025-08-21
Description: Xftp FTP Client version up to and including 3.0 (build 0238) contain a stack-based buffer overflow vulnerability triggered by a maliciously crafted PWD response from an FTP server. When the client connects to a server and receives an overly long directory string in response to the PWD command, the client fails to properly validate the length of the input before copying it into a fixed-size buffer. This results in memory corruption and allows remote attackers to execute arbitrary code on the client system.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/xftp_client_pwd.rb; https://web.archive.org/web/[PII_REDACTED]2219/http://www.netsarang.com/download/down_xft3.html; https://www.exploit-db.com/exploits/12332
CVE: CVE-2010-20123
Published: 2025-08-21
Description: Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to overwrite critical memory structures and execute arbitrary code. This vulnerability can be exploited locally by convincing a user to open a malicious .m3u file.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mymp3player_m3u.rb; https://www.chip.de/downloads/myMP3-Player_13008621.html; https://www.exploit-db.com/exploits/11791
CVE: CVE-2025-43747
Published: 2025-08-21
Description: A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation is not distinguishing between trusted subdomains and malicious domains.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43747
CVE: CVE-2025-51606
Published: 2025-08-21
Description: hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250610-01.md
CVE: CVE-2023-3948
Published: 2025-08-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-4131
Published: 2025-08-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-4143
Published: 2025-08-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-43753
Published: 2025-08-21
Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 update 32 through update 92 allows an remote authenticated user to inject JavaScript into the embedded message field from the form container.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43753
CVE: CVE-2025-43752
Published: 2025-08-22
Description: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to cause a potential DDoS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43752
CVE: CVE-2025-41451
Published: 2025-08-22
Description: Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.
CWE: CWE-77
References: https://www.danfoss.com/en/service-and-support/downloads/dcs/adap-kool-software/ak-sm-800a/#tab-overview
CVE: CVE-2025-41452
Published: 2025-08-22
Description: Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions
CWE: CWE-15
References: https://www.danfoss.com/en/service-and-support/downloads/dcs/adap-kool-software/ak-sm-800a/#tab-overview
CVE: CVE-2025-8281
Published: 2025-08-22
Description: The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin and unauthenticated users.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/36b9305e-e086-4edb-bff9-d181ea316389/
CVE: CVE-2025-57699
Published: 2025-08-22
Description: Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path.
A user with the write permission on the root directory of the system drive may execute arbitrary code with the SYSTEM privilege.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://jvn.jp/en/jp/JVN75211379/; https://www.westerndigital.com/support/product-security/wdc-25004-western-digital-kitfox-software-version-1-1-1-1
CVE: CVE-2025-8678
Published: 2025-08-22
Description: The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/wp-crontrol/trunk/src/bootstrap.php#L2712; https://plugins.trac.wordpress.org/changeset/3347075/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ab40146d-9b49-4214-af73-41c5b5512542?source=cve
CVE: CVE-2025-9341
Published: 2025-08-22
Description: Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files org/bouncycastle/crypto/fips/AESNativeCBC.Java, org/bouncycastle/crypto/engines/AESNativeCBC.Java.

This issue affects Bouncy Castle for Java FIPS: 2.1.0; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.
CWE: CWE-400
References: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%909341
CVE: CVE-2025-9340
Published: 2025-08-22
Description: Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules). This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher.

This issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0.
CWE: CWE-787
References: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%909340
CVE: CVE-2025-57884
Published: 2025-08-22
Description: Missing Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greenshift: from n/a through <= 12.1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/greenshift-animation-and-page-builder-blocks/vulnerability/wordpress-greenshift-plugin-12-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57885
Published: 2025-08-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Cross Site Request Forgery.This issue affects Fluent Support: from n/a through <= 1.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/fluent-support/vulnerability/wordpress-fluent-support-plugin-1-9-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57886
Published: 2025-08-22
Description: Authorization Bypass Through User-Controlled Key vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.30.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/accessibility-checker/vulnerability/wordpress-accessibility-checker-by-equalize-digital-plugin-1-30-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-57887
Published: 2025-08-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Stored XSS.This issue affects Jobmonster: from n/a through <= 4.8.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/noo-jobmonster/vulnerability/wordpress-jobmonster-theme-4-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57888
Published: 2025-08-22
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NooTheme Jobmonster noo-jobmonster allows Retrieve Embedded Sensitive Data.This issue affects Jobmonster: from n/a through <= 4.8.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Theme/noo-jobmonster/vulnerability/wordpress-jobmonster-theme-4-8-0-sensitive-data-exposure-vulnerability?_s_id=cve