deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2472
Published: 2025-03-18
Description: A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/l8BL/vul_report/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.299965
CVE: CVE-2025-2473
Published: 2025-03-18
Description: A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/l8BL/vul_report/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.299966
CVE: CVE-2025-2262
Published: 2025-03-18
Description: The The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.7.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/gs-logo-slider/trunk/includes/shortcode-builder/builder.php#L31; https://plugins.trac.wordpress.org/browser/gs-logo-slider/trunk/includes/shortcode-builder/builder.php#L51; https://plugins.trac.wordpress.org/browser/gs-logo-slider/trunk/includes/shortcode-builder/builder.php#L65
CVE: CVE-2025-0755
Published: 2025-03-18
Description: The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
CVSS Score: 8.4 (HIGH)
CWE: CWE-122
References: https://jira.mongodb.org/browse/CDRIVER-5601; https://jira.mongodb.org/browse/SERVER-94461; https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html
CVE: CVE-2025-24306
Published: 2025-03-18
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.0_1101. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker with an administrative privilege.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://fsi-plusf.jp/news/25031701.html; https://jvn.jp/en/jp/JVN11230428/
CVE: CVE-2025-25220
Published: 2025-03-18
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.1_1101. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://fsi-plusf.jp/news/25031701.html; https://jvn.jp/en/jp/JVN11230428/
CVE: CVE-2024-23942
Published: 2025-03-18
Description: A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from accessing the cloud portal which leads to a DoS.
CVSS Score: 7.1 (HIGH)
CWE: CWE-312
References: https://cert.vde.com/en/advisories/VDE-2024-010
CVE: CVE-2024-23943
Published: 2025-03-18
Description: An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2024-010
CVE: CVE-2024-41975
Published: 2025-03-18
Description: An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1188
References: https://cert.vde.com/en/advisories/VDE-2025-013
CVE: CVE-2025-0694
Published: 2025-03-18
Description: Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-22
References: https://cert.vde.com/en/advisories/VDE-2025-015
CVE: CVE-2025-1468
Published: 2025-03-18
Description: An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15 security policy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://cert.vde.com/en/advisories/VDE-2025-022
CVE: CVE-2025-2489
Published: 2025-03-18
Description: Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json.
CWE: CWE-922
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-storage-sensitive-information-ntfs-tool
CVE: CVE-2025-2493
Published: 2025-03-18
Description: Path Traversal vulnerability in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to manipulate the ‘id’ parameter of the ‘/softdial/scheduler/load.php’ endpoint to navigate beyond the intended directory. This can allow unauthorised access to sensitive files outside the expected scope, posing a security risk.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-softdial-contact-center
CVE: CVE-2025-2494
Published: 2025-03-18
Description: Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server via the ‘/softdial/phpconsole/upload.php’ endpoint, which is protected by basic HTTP authentication. The files are uploaded to a directory exposed by the web application, which could result in code execution, giving the attacker full control over the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-softdial-contact-center
CVE: CVE-2025-2495
Published: 2025-03-18
Description: Stored Cross-Site Scripting (XSS) in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the server with JavaScript code injected via the ‘/softdial/scheduler/save.php’ resource. The injected code will execute when the uploaded file is loaded via the ‘/softdial/scheduler/load.php’ resource and can redirect the victim to malicious sites or steal their login information to spoof their identity.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-softdial-contact-center
CVE: CVE-2023-47539
Published: 2025-03-18
Description: An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauthenticated attacker to bypass admin login via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://fortiguard.com/psirt/FG-IR-23-439
CVE: CVE-2024-21760
Published: 2025-03-18
Description: An improper control of generation of code ('Code Injection') vulnerability [CWE-94] in FortiSOAR Connector FortiSOAR 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an authenticated attacker to execute arbitrary code on the host via a playbook code snippet.
CVSS Score: 8.4 (HIGH)
CWE: CWE-94
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-420
CVE: CVE-2024-8997
Published: 2025-03-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vestel EVC04 Configuration Interface allows SQL Injection.This issue affects EVC04 Configuration Interface: before V3.187, V4.53.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0070
CVE: CVE-2025-25500
Published: 2025-03-18
Description: An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://gist.github.com/H3T76/8096a6ff9410f3a6d9a25db1a68ae657#file-cve-2025-25500; https://gist.github.com/H3T76/8096a6ff9410f3a6d9a25db1a68ae657#file-cve-2025-25500
CVE: CVE-2025-2449
Published: 2025-03-18
Description: NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of URI files by the usiReg component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21805.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-146/
CVE: CVE-2025-2450
Published: 2025-03-18
Description: NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI Vision Builder AI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of VBAI files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22833.
CVSS Score: 8.8 (HIGH)
CWE: CWE-356
References: https://www.zerodayinitiative.com/advisories/ZDI-25-147/
CVE: CVE-2025-2490
Published: 2025-03-18
Description: A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileUploadController.java of the component File Upload. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/dromara/ujcms/issues/12; https://github.com/dromara/ujcms/issues/13; https://vuldb.com/?ctiid.299996
CVE: CVE-2025-30106
Published: 2025-03-18
Description: On IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. This allows an attacker within Wi-Fi range to connect to the device's network to perform sniffing.
CVSS Score: 8.8 (HIGH)
CWE: CWE-259
References: https://github.com/geo-chen/IROAD-V; https://iroad-dashcam.nl/iroad/iroad-x5/
CVE: CVE-2024-44313
Published: 2025-03-18
Description: TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php; https://medium.com/@cnetsec/cve-2024-44313-incorrect-access-control-in-tastyigniter-3-7-6-01a73c548b74
CVE: CVE-2024-44314
Published: 2025-03-18
Description: TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the index_onUpdateStatus() function within Orders.php, which fails to verify if the user has permission to modify an order's status. This flaw can be exploited remotely, leading to unauthorized order manipulation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php; https://medium.com/@cnetsec/cve-2024-44314-incorrect-access-control-in-function-updateorder-fc5f2b1b0467
CVE: CVE-2024-49822
Published: 2025-03-18
Description: IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-918
References: https://www.ibm.com/support/pages/node/7186424
CVE: CVE-2025-25580
Published: 2025-03-18
Description: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/r1bbit/yimioa/issues/IBI6XT
CVE: CVE-2025-25585
Published: 2025-03-18
Description: Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitrarily modify Administrator passwords.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://gitee.com/r1bbit/yimioa/issues/IBI7PG
CVE: CVE-2025-25590
Published: 2025-03-18
Description: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/r1bbit/yimioa/issues/IBI7XH
CVE: CVE-2025-2491
Published: 2025-03-18
Description: A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component Edit Template File Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/dromara/ujcms/issues/14; https://vuldb.com/?ctiid.299997; https://vuldb.com/?id.299997
CVE: CVE-2025-30107
Published: 2025-03-18
Description: On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in the dashcam's configuration management allows unauthorized users to modify settings, disable critical functions, and turn off battery protection, potentially causing physical damage to the vehicle.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/geo-chen/IROAD-V; https://iroad-dashcam.nl/iroad/iroad-x5/%27
CVE: CVE-2025-30109
Published: 2025-03-18
Description: In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092. The mobile application for the dashcam contains hardcoded credentials that allow an attacker on the local Wi-Fi network to access API endpoints and retrieve sensitive device information, including live and recorded footage.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://github.com/geo-chen/IROAD-V; https://iroad-dashcam.nl/iroad/iroad-x5/
CVE: CVE-2025-30110
Published: 2025-03-18
Description: On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism relies solely on MAC address verification, allowing an attacker to bypass authentication by spoofing an already-paired MAC address that can be captured via an ARP scan.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://github.com/geo-chen/IROAD-V; https://iroad-dashcam.nl/iroad/iroad-x5/
CVE: CVE-2025-30111
Published: 2025-03-18
Description: On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained access through other means, to list and download recorded videos, as well as access live video streams without proper authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/geo-chen/IROAD-V; https://iroad-dashcam.nl/iroad/iroad-x5/
CVE: CVE-2025-30113
Published: 2025-03-18
Description: An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for Ports 9091 and 9092. The dashcam's Android application contains hardcoded credentials that allow unauthorized access to device settings through ports 9091 and 9092. These credentials, stored in cleartext, can be exploited by an attacker who gains access to the dashcam's network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/geo-chen/Hella; https://medium.com/@geochen/cve-draft-hella-driving-recorder-dr-820-ff8c4e2cca26
CVE: CVE-2025-30114
Published: 2025-03-18
Description: An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the connecting device's MAC address. By obtaining the MAC address through network scanning and spoofing it, an attacker can bypass the authentication process and gain full access to the dashcam's features without proper authorization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/geo-chen/Hella; https://medium.com/@geochen/cve-draft-hella-driving-recorder-dr-820-ff8c4e2cca26
CVE: CVE-2025-30115
Published: 2025-03-18
Description: An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSID and password ("qwertyuiop"), which cannot be modified by users. The SSID is continuously broadcast, allowing unauthorized access to the device network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259
References: https://github.com/geo-chen/Hella; https://medium.com/@geochen/cve-draft-hella-driving-recorder-dr-820-ff8c4e2cca26
CVE: CVE-2025-30116
Published: 2025-03-18
Description: An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can occur. It allows remote attackers to access and download recorded video footage from the SD card via port 9091. Additionally, attackers can connect to port 9092 to stream the live video feed by bypassing the challenge-response authentication mechanism. This exposes sensitive location and personal data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/geo-chen/Hella; https://medium.com/@geochen/cve-draft-hella-driving-recorder-dr-820-ff8c4e2cca26
CVE: CVE-2025-30117
Published: 2025-03-18
Description: An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. After bypassing the device pairing, an attacker can obtain sensitive user and vehicle information through the settings interface. Remote attackers can modify power management settings, disable recording, delete stored footage, and turn off battery protection, leading to potential denial-of-service conditions and vehicle battery drainage.
CVSS Score: 7.3 (HIGH)
CWE: CWE-285
References: https://github.com/geo-chen/Hella; https://medium.com/@geochen/cve-draft-hella-driving-recorder-dr-820-ff8c4e2cca26
CVE: CVE-2025-30122
Published: 2025-03-18
Description: An issue was discovered on ROADCAM X3 devices. It has a uniform default credential set that cannot be modified by users, making it easy for attackers to gain unauthorized access to multiple devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/geo-chen/RoadCam; https://roadcam.my/pages/install-x3
CVE: CVE-2025-30123
Published: 2025-03-18
Description: An issue was discovered on ROADCAM X3 devices. The mobile app APK (Viidure) contains hardcoded FTP credentials for the FTPX user account, enabling attackers to gain unauthorized access and extract sensitive recorded footage from the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/geo-chen/RoadCam; https://roadcam.my/pages/install-x3
CVE: CVE-2025-30132
Published: 2025-03-18
Description: An issue was discovered on IROAD Dashcam V devices. It uses an unregistered public domain name as an internal domain, creating a security risk. During analysis, it was found that this domain was not owned by IROAD, allowing an attacker to register it and potentially intercept sensitive device traffic. If the dashcam or related services attempt to resolve this domain over the public Internet instead of locally, it could lead to data exfiltration or man-in-the-middle attacks.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://github.com/geo-chen/IROAD-V; https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-6-public-domain-used-for-internal-domain-name
CVE: CVE-2024-57169
Published: 2025-03-18
Description: A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass upload restrictions and potentially achieve remote code execution by uploading malicious files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://themcsam.github.io/posts/so-planing-vulnerabilities/#arbitrary-file-upload-leading-to-rce; https://themcsam.github.io/posts/so-planing-vulnerabilities/#arbitrary-file-upload-leading-to-rce
CVE: CVE-2024-57170
Published: 2025-03-18
Description: SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" parameter allows authenticated attackers to specify file paths containing directory traversal sequences (e.g., ../). This vulnerability enables attackers to delete arbitrary files outside the intended upload directory, potentially leading to denial of service or disruption of application functionality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://themcsam.github.io/posts/so-planing-vulnerabilities/#arbitrary-file-deletion; https://themcsam.github.io/posts/so-planing-vulnerabilities/#arbitrary-file-deletion
CVE: CVE-2025-25582
Published: 2025-03-18
Description: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.xml.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/r1bbit/yimioa/issues/IBI74K
CVE: CVE-2025-25586
Published: 2025-03-18
Description: yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-538
References: https://gitee.com/r1bbit/yimioa/issues/IBI7LR
CVE: CVE-2025-25589
Published: 2025-03-18
Description: An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file.
CVSS Score: 8.1 (HIGH)
CWE: CWE-91
References: https://gitee.com/r1bbit/yimioa/issues/IBI81R
CVE: CVE-2025-27688
Published: 2025-03-18
Description: Dell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.dell.com/support/kbdoc/en-us/000289886/dsa-2025-107