deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27350
Published: 2023-04-20
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html; http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html; http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html
CVE: CVE-2023-27351
Published: 2023-04-20
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.papercut.com/kb/Main/PO-1216-and-PO-1219; https://www.zerodayinitiative.com/advisories/ZDI-23-232/; https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
CVE: CVE-2023-1255
Published: 2023-04-20
Description: Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM
platform contains a bug that could cause it to read past the input buffer,
leading to a crash.

Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM
platform can crash in rare circumstances. The AES-XTS algorithm is usually
used for disk encryption.

The AES-XTS cipher decryption implementation for 64 bit ARM platform will read
past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16
byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext
buffer is unmapped, this will trigger a crash which results in a denial of
service.

If an attacker can control the size and location of the ciphertext buffer
being decrypted by an application using AES-XTS on 64 bit ARM, the
application is affected. This is fairly unlikely making this issue
a Low severity one.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=02ac9c[PII_REDACTED]472f33b01def01218742b8bb; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bc2f61ad70971869b242fc1cb445b98bad50074a; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-23938
Published: 2023-04-20
Description: Tuleap is a Free & Source tool for end to end traceability of application and system developments. Affected versions are subject to a cross site scripting attack which can be injected in the name of a color of select box values of a tracker and then reflected in the tracker administration. Administrative privilege is required, but an attacker with tracker administration rights could use this vulnerability to force a victim to execute uncontrolled code in the context of their browser. This issue has been addressed in Tuleap Community Edition version 14.5.99.4. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://github.com/Enalean/tuleap/commit/aacd5e798301f24f218298ec8236ec7bef0f5d52; https://github.com/Enalean/tuleap/security/advisories/GHSA-mqjm-c6rm-9h87; https://tuleap.net/plugins/tracker/?aid=30734
CVE: CVE-2023-27495
Published: 2023-04-20
Description: @fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions. @fastify/csrf-protection supports an optional userInfo parameter that binds the CSRF token to the user. This parameter has been introduced to prevent cookie-tossing attacks as a fix for CVE-2021-29624. Whenever userInfo parameter is missing, or its value can be predicted for the target user account, network and same-site attackers can 1. fixate a _csrf cookie in the victim's browser, and 2. forge CSRF tokens that are valid for the victim's session. This allows attackers to bypass the CSRF protection mechanism. As a fix, @fastify/csrf-protection starting from version 6.3.0 (and v4.1.0) includes a server-defined secret hmacKey that cryptographically binds the CSRF token to the value of the _csrf cookie and the userInfo parameter, making tokens non-spoofable by attackers. This protection is effective as long as the userInfo parameter is unique for each user. This is patched in versions 6.3.0 and v4.1.0. Users are advised to upgrade. Users unable to upgrade may use a random, non-predictable userInfo parameter for each user as a mitigation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/fastify/csrf-protection/commit/be3e5761f37aa05c7c1ac8ed44499c51ecec8058; https://github.com/fastify/csrf-protection/security/advisories/GHSA-qrgf-9gpc-vrxw; https://www.cvedetails.com/cve/CVE-2021-29624
CVE: CVE-2023-29528
Published: 2023-04-20
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version including the fix.

CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-commons/commit/8ff1a9d7e5d7b45b690134a537d53dc05cae04ab; https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-x37v-36wv-6v6h; https://jira.xwiki.org/browse/XCOMMONS-2568
CVE: CVE-2023-30616
Published: 2023-04-20
Description: Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery due to a missing nonce check. There is potential for a Cross Site Request Forgery for all form blocks, since it allows to send requests to the forms from any website without a user noticing. Users are advised to upgrade to version 1.0.2. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/epiphyt/form-block/commit/cf0012fa0710d906c594346ba775c5dc433a9426; https://github.com/epiphyt/form-block/security/advisories/GHSA-j4c2-7p87-q824; https://github.com/epiphyt/form-block/commit/cf0012fa0710d906c594346ba775c5dc433a9426
CVE: CVE-2023-22295
Published: 2023-04-20
Description: Datakit CrossCadWare_x64.dll contains an out of bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information.


CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14; https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14
CVE: CVE-2023-22321
Published: 2023-04-20
Description: 


Datakit CrossCadWare_x64.dll contains an out-of-bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information. 

 


CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14; https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14
CVE: CVE-2023-22354
Published: 2023-04-20
Description: 




Datakit CrossCadWare_x64.dll contains an out-of-bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information. 

 

 


CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14; https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14
CVE: CVE-2023-22846
Published: 2023-04-20
Description: 






Datakit CrossCadWare_x64.dll contains an out-of-bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information. 

 

 

 


CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14; https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14
CVE: CVE-2023-23579
Published: 2023-04-20
Description: 








Datakit CrossCadWare_x64.dll contains an out-of-bounds write past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This could allow an attacker to execute code in the context of the current process. 

 

 

 

 


CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14; https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14
CVE: CVE-2023-30076
Published: 2023-04-20
Description: Sourcecodester Judging Management System v1.0 is vulnerable to SQL Injection via /php-jms/print_judges.php?print_judges.php=&se_name=&sub_event_id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Dzero57/cve_report/blob/main/judging-management-system/SQLi-2.md; https://github.com/Dzero57/cve_report/blob/main/judging-management-system/SQLi-2.md
CVE: CVE-2023-27090
Published: 2023-04-20
Description: Cross Site Scripting vulnerability found in TeaCMS storage allows attacker to cause a leak of sensitive information via the article title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitee.com/xiaobingby/TeaCMS/issues/I6GDDN; https://gitee.com/xiaobingby/TeaCMS/issues/I6L9Z2; https://gitee.com/xiaobingby/TeaCMS/issues/I6GDDN
CVE: CVE-2021-36436
Published: 2023-04-20
Description: An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-640, CWE-640
References: https://github.com/Laransec/Mobicint; https://github.com/Laransec/Mobicint
CVE: CVE-2023-20864
Published: 2023-04-20
Description: VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.vmware.com/security/advisories/VMSA-2023-0007.html; https://www.vmware.com/security/advisories/VMSA-2023-0007.html
CVE: CVE-2023-20865
Published: 2023-04-20
Description: VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.vmware.com/security/advisories/VMSA-2023-0007.html; https://www.vmware.com/security/advisories/VMSA-2023-0007.html
CVE: CVE-2023-20873
Published: 2023-04-20
Description: In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
CVSS Score: 9.8 (CRITICAL)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://spring.io/blog/2023/05/18/spring-boot-2-5-15-and-2-6-15-available-now; https://spring.io/security/cve-2023-20873
CVE: CVE-2023-28458
Published: 2023-04-20
Description: pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/pretalx/pretalx/commit/60722c43cf975f319e94102e6bff[PII_REDACTED]90; https://github.com/pretalx/pretalx/releases/tag/v2.3.2; https://pretalx.com/p/news/security-release-232/
CVE: CVE-2023-28459
Published: 2023-04-20
Description: pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/pretalx/pretalx/commit/60722c43cf975f319e94102e6bff[PII_REDACTED]90; https://github.com/pretalx/pretalx/releases/tag/v2.3.2; https://pretalx.com/p/news/security-release-232/
CVE: CVE-2023-2131
Published: 2023-04-20
Description: Versions of INEA ME RTU firmware prior to 3.36 are vulnerable to OS command injection, which could allow an attacker to remotely execute arbitrary code.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-110-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-110-01
CVE: CVE-2023-2176
Published: 2023-04-20
Description: A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.spinics.net/lists/linux-rdma/msg114749.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-2177
Published: 2023-04-20
Description: A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=181d8d2066c0; https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=181d8d2066c0
CVE: CVE-2023-2194
Published: 2023-04-20
Description: An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2188396; https://github.com/torvalds/linux/commit/92fbb6d1296f; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE: CVE-2023-27352
Published: 2023-04-20
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the SMB directory query command. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19845.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-447/; https://www.zerodayinitiative.com/advisories/ZDI-23-447/
CVE: CVE-2023-27353
Published: 2023-04-20
Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msprox endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-19846.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-448/; https://www.zerodayinitiative.com/advisories/ZDI-23-448/
CVE: CVE-2023-27354
Published: 2023-04-20
Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the SMB directory query command. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before reading from memory. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-19727.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://www.zerodayinitiative.com/advisories/ZDI-23-446/; https://www.zerodayinitiative.com/advisories/ZDI-23-446/
CVE: CVE-2023-27355
Published: 2023-04-20
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MPEG-TS parser. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19773.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-23-449/; https://www.zerodayinitiative.com/advisories/ZDI-23-449/
CVE: CVE-2023-2202
Published: 2023-04-21
Description: Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/francoisjacquet/rosariosis/commit/6433946abfb34324616e833b1c00d0b2450753be; https://huntr.dev/bounties/efe6ef47-d17c-4773-933a-4836c32db85c; https://github.com/francoisjacquet/rosariosis/commit/6433946abfb34324616e833b1c00d0b2450753be
CVE: CVE-2023-1892
Published: 2023-04-21
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/sidekiq/sidekiq/commit/458fdf74176a9881478c48dc5cf0269107b22214; https://huntr.dev/bounties/e35e5653-c429-4fb8-94a3-cbc123ae4777; https://github.com/sidekiq/sidekiq/commit/458fdf74176a9881478c48dc5cf0269107b22214
CVE: CVE-2023-27751
Published: 2023-04-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-27752
Published: 2023-04-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-2204
Published: 2023-04-21
Description: A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file faqs.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226969 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Retro%20Basketball%20Shoes%20Online%20Store/Retro%20Basketball%20Shoes%20Online%20Store%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.226969; https://vuldb.com/?id.226969
CVE: CVE-2023-2205
Published: 2023-04-21
Description: A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /function/login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-226970 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Retro%20Basketball%20Shoes%20Online%20Store/Retro%20Basketball%20Shoes%20Online%20Store%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.226970; https://vuldb.com/?id.226970
CVE: CVE-2023-2206
Published: 2023-04-21
Description: A vulnerability classified as critical has been found in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file contactus.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226971.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Retro%20Basketball%20Shoes%20Online%20Store/Retro%20Basketball%20Shoes%20Online%20Store%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.226971; https://vuldb.com/?id.226971
CVE: CVE-2023-2207
Published: 2023-04-21
Description: A vulnerability classified as critical was found in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file contactus1.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226972.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Retro%20Basketball%20Shoes%20Online%20Store/Retro%20Basketball%20Shoes%20Online%20Store%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.226972; https://vuldb.com/?id.226972
CVE: CVE-2023-2208
Published: 2023-04-21
Description: A vulnerability, which was classified as critical, has been found in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file details.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226973 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Retro%20Basketball%20Shoes%20Online%20Store/Retro%20Basketball%20Shoes%20Online%20Store%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.226973; https://vuldb.com/?id.226973