deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-22473
Published: 2025-03-17
Description: Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://www.dell.com/support/kbdoc/en-us/000289970/dsa-2025-070-security-update-for-dell-networking-os10-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000293638/dsa-2025-069-security-update-for-dell-networking-os10-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000294091/dsa-2025-079-security-update-for-dell-networking-os10-vulnerabilities
CVE: CVE-2025-26125
Published: 2025-03-17
Description: An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-782
References: https://github.com/ZeroMemoryEx/CVE-2025-26125; https://github.com/ZeroMemoryEx/IObit-EoP; https://x.com/zeromemoryex/status/[PII_REDACTED]00449819
CVE: CVE-2025-29429
Published: 2025-03-17
Description: Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/program.php via the id, code, and name parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/872323857/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System-program.php.md
CVE: CVE-2025-29430
Published: 2025-03-17
Description: Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.php via the id and rome parameters.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-80
References: https://github.com/872323857/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System-room.php.md
CVE: CVE-2025-2387
Published: 2025-03-17
Description: A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file /admin/ajax.php?action=add_to_cart. The manipulation of the argument pid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/aionman/cve/issues/9; https://vuldb.com/?ctiid.299886; https://vuldb.com/?id.299886
CVE: CVE-2025-2388
Published: 2025-03-17
Description: A vulnerability was found in Keytop 路内停车收费系统 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /saas/commonApi/park/getParks of the component API. The manipulation leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/K-mxredo/MXdocument/wiki; https://vuldb.com/?ctiid.299887; https://vuldb.com/?id.299887
CVE: CVE-2024-44866
Published: 2025-03-17
Description: A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via opening a crafted GuitarPro file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://github.com/moonadon9/CVE_2024; https://musescore.org/ko/download/musescore.msi
CVE: CVE-2024-8510
Published: 2025-03-17
Description: N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. 

This vulnerability is present in all deployments of N-central prior to N-central 2024.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-23
References: https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2024.6_Release_Notes.htm; https://me.n-able.com/s/security-advisory/aArVy0000000XgjKAE/cve20248510-ncentral-path-traversal
CVE: CVE-2025-26042
Published: 2025-03-17
Description: Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-1333
References: https://github.com/louislam/uptime-kuma/commit/7a9191761dbef6551c2a0aa6eed5f693ba48d688; https://github.com/louislam/uptime-kuma/issues/5574; https://github.com/louislam/uptime-kuma/pull/5573
CVE: CVE-2025-29425
Published: 2025-03-17
Description: Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in exam_save.php via the parameters member and first.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/872323857/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System.md
CVE: CVE-2025-29427
Published: 2025-03-17
Description: Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in profile.php via the member_first and member_last parameters.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-80
References: https://github.com/872323857/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System-profile.pdf
CVE: CVE-2025-2389
Published: 2025-03-17
Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_city.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/intercpt/XSS1/blob/main/SQL7.md; https://vuldb.com/?ctiid.299888
CVE: CVE-2025-2390
Published: 2025-03-17
Description: A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /user_dashboard/add_donor.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/intercpt/XSS1/blob/main/SQL8.md; https://vuldb.com/?ctiid.299889
CVE: CVE-2024-44276
Published: 2025-03-17
Description: This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2. A user in a privileged network position may be able to leak sensitive information.
CVSS Score: 7.3 (HIGH)
CWE: CWE-319
References: https://support.apple.com/en-us/121837
CVE: CVE-2024-54525
Published: 2025-03-17
Description: A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Restoring a maliciously crafted backup file may lead to modification of protected system files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://support.apple.com/en-us/121837; https://support.apple.com/en-us/121839; https://support.apple.com/en-us/121843
CVE: CVE-2024-54559
Published: 2025-03-17
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/121839
CVE: CVE-2024-54565
Published: 2025-03-17
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/121839
CVE: CVE-2025-0495
Published: 2025-03-17
Description: Buildx is a Docker CLI plugin that extends build capabilities using BuildKit.

Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records.


This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.
CWE: CWE-532
References: https://github.com/docker/buildx
CVE: CVE-2025-24185
Published: 2025-03-17
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. Parsing a maliciously crafted file may lead to an unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://support.apple.com/en-us/122068; https://support.apple.com/en-us/122069; https://support.apple.com/en-us/122070
CVE: CVE-2025-25914
Published: 2025-03-17
Description: SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/872323857/CVE/blob/main/online-exam-mastering-system_sqlinject.md
CVE: CVE-2025-26393
Published: 2025-03-17
Description: SolarWinds Service Desk is affected by a broken access control vulnerability. The issue allows authenticated users to escalate privileges, leading to unauthorized data manipulation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-653
References: https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26393
CVE: CVE-2025-2391
Published: 2025-03-17
Description: A vulnerability classified as critical was found in code-projects Blood Bank Management System 1.0. This vulnerability affects unknown code of the file /admin/admin_login.php of the component Admin Login Page. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/intercpt/XSS1/blob/main/SQL10.md; https://vuldb.com/?ctiid.299890
CVE: CVE-2025-2392
Published: 2025-03-17
Description: A vulnerability, which was classified as critical, has been found in code-projects Online Class and Exam Scheduling System 1.0. This issue affects some unknown processing of the file /pages/activate.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/intercpt/XSS1/blob/main/SQL11.md; https://vuldb.com/?ctiid.299891
CVE: CVE-2025-29426
Published: 2025-03-17
Description: Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cys parameters.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-80
References: https://github.com/872323857/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System-class.php.md
CVE: CVE-2025-2393
Published: 2025-03-17
Description: A vulnerability, which was classified as critical, was found in code-projects Online Class and Exam Scheduling System 1.0. Affected is an unknown function of the file /pages/salut_del.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/intercpt/XSS1/blob/main/SQL12.md; https://vuldb.com/?ctiid.299892
CVE: CVE-2025-2397
Published: 2025-03-17
Description: A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been declared as problematic. This vulnerability affects unknown code of the component Telnet Service. The manipulation leads to improper authorization. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-266, CWE-285
References: https://github.com/Fizz-L/Vulnerability-report/blob/main/Unauthorized%20access%20to%20execute%20the%20telnet%20command.md; https://vuldb.com/?ctiid.299896; https://vuldb.com/?id.299896
CVE: CVE-2024-40635
Published: 2025-03-17
Description: containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-190
References: https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da; https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20; https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a
CVE: CVE-2025-29781
Published: 2025-03-17
Description: The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource `BMCEventSubscription`. Prior to versions 0.8.1 and 0.9.1, an adversary Kubernetes account with only namespace level roles (e.g. a tenant controlling a namespace) may create a `BMCEventSubscription` in his authorized namespace and then load Secrets from his unauthorized namespaces to his authorized namespace via the Baremetal Operator, causing Secret Leakage. The patch makes BMO refuse to read Secrets from other namespace than where the corresponding BMH resource is. The patch does not change the `BMCEventSubscription` API in BMO, but stricter validation will fail the request at admission time. It will also prevent the controller reading such Secrets, in case the BMCES CR has already been deployed. The issue exists for all versions of BMO, and is patched in BMO releases v0.9.1 and v0.8.1. Prior upgrading to patched BMO version, duplicate any existing Secret pointed to by `BMCEventSubscription`'s `httpHeadersRef` to the same namespace where the corresponding BMH exists. After upgrade, remove the old Secrets. As a workaround, the operator can configure BMO RBAC to be namespace scoped, instead of cluster scoped, to prevent BMO from accessing Secrets from other namespaces, and/or use `WATCH_NAMESPACE` configuration option to limit BMO to single namespace.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-653
References: https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c; https://github.com/metal3-io/baremetal-operator/pull/2321; https://github.com/metal3-io/baremetal-operator/pull/2322
CVE: CVE-2025-29909
Published: 2025-03-17
Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, a heap buffer overflow vulnerability in CryptoLib's `Crypto_TC_ApplySecurity()` allows an attacker to craft a malicious TC frame that causes out-of-bounds memory writes. This can result in denial of service (DoS) or, under certain conditions, remote code execution (RCE). Any application or system that relies on CryptoLib for Telecommand (TC) processing and does not strictly validate incoming TC frames is at risk. This includes satellite ground stations or mission control software where attackers can inject malformed frames. A patch is available at commit c7e8a8745ff4b5e9bd7e500e91358e86d5abedcc.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191, CWE-787
References: https://github.com/nasa/CryptoLib/commit/c7e8a8745ff4b5e9bd7e500e91358e86d5abedcc; https://github.com/nasa/CryptoLib/security/advisories/GHSA-q2pc-c3jx-3852; https://github.com/nasa/CryptoLib/security/advisories/GHSA-q2pc-c3jx-3852
CVE: CVE-2025-29910
Published: 2025-03-17
Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A memory leak vulnerability was identified in the `crypto_handle_incrementing_nontransmitted_counter` function of CryptoLib versions 1.3.3 and prior. This vulnerability can lead to resource exhaustion and degraded system performance over time, particularly in long-running processes or systems processing large volumes of data. The vulnerability is present in the `crypto_handle_incrementing_nontransmitted_counter` function within `crypto_tc.c`. The function allocates memory using `malloc` without ensuring the allocated memory is always freed. This issue can lead to resource exhaustion, reduced system performance, and potentially a Denial of Service (DoS) in environments where CryptoLib is used in long-running processes or with large volumes of data. Any system using CryptoLib, especially those handling high-throughput or continuous data streams, could be impacted. As of time of publication, no known patched versions are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/nasa/CryptoLib/security/advisories/GHSA-p38w-p2r8-g6g5; https://github.com/nasa/CryptoLib/security/advisories/GHSA-p38w-p2r8-g6g5
CVE: CVE-2025-2398
Published: 2025-03-17
Description: A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been rated as critical. This issue affects some unknown processing of the component CLI su Command Handler. The manipulation leads to use of default credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1392
References: https://github.com/Fizz-L/Vulnerability-report/blob/main/Unauthorized%20access%20to%20execute%20the%20telnet%20command.md; https://vuldb.com/?ctiid.299897; https://vuldb.com/?id.299897
CVE: CVE-2025-2419
Published: 2025-03-17
Description: A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /InsertFeedback.php. The manipulation of the argument txtName/txtEmail/txtMobile/txtFeedback leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/heiheiworld/cve/blob/main/cve-h.md; https://vuldb.com/?ctiid.299916
CVE: CVE-2025-29911
Published: 2025-03-17
Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_AOS_ProcessSecurity` function of CryptoLib versions 1.3.3 and prior. This vulnerability allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a maliciously crafted AOS frame with an insufficient length. The vulnerability lies in the function `Crypto_AOS_ProcessSecurity`, specifically during the processing of the Frame Error Control Field (FECF). The affected code attempts to read from the `p_ingest` buffer at indices `current_managed_parameters_struct.max_frame_size - 2` and `current_managed_parameters_struct.max_frame_size - 1` without verifying if `len_ingest` is sufficiently large. This leads to a heap buffer overflow when `len_ingest` is smaller than `max_frame_size`. As of time of publication, no known patched versions exist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://github.com/nasa/CryptoLib/security/advisories/GHSA-7g6g-9gj4-8c68; https://github.com/nasa/CryptoLib/security/advisories/GHSA-7g6g-9gj4-8c68
CVE: CVE-2025-29912
Published: 2025-03-17
Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, an unsigned integer underflow in the `Crypto_TC_ProcessSecurity` function of CryptoLib leads to a heap buffer overflow. The vulnerability is triggered when the `fl` (frame length) field in a Telecommand (TC) packet is set to 0. This underflow causes the frame length to be interpreted as 65535, resulting in out-of-bounds memory access. This critical vulnerability can be exploited to cause a denial of service (DoS) or potentially achieve remote code execution. Users of CryptoLib are advised to apply the recommended patch or avoid processing untrusted TC packets until a fix is available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-191, CWE-787
References: https://github.com/nasa/CryptoLib/commit/ca39cb96f21e76102aefb956d2c8c0ba0bd143ca; https://github.com/nasa/CryptoLib/security/advisories/GHSA-3f5x-r59x-p8cf
CVE: CVE-2025-29913
Published: 2025-03-17
Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_TC_Prep_AAD` function of CryptoLib versions 1.3.3 and prior. This vulnerability allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a maliciously crafted telecommand (TC) frame that causes an unsigned integer underflow. The vulnerability lies in the function `Crypto_TC_Prep_AAD`, specifically during the computation of `tc_mac_start_index`. The affected code incorrectly calculates the MAC start index without ensuring it remains within the bounds of the `ingest` buffer. When `tc_mac_start_index` underflows due to an incorrect length calculation, the function attempts to access an out-of-bounds memory location, leading to a segmentation fault. The vulnerability is still present in the repository as of commit `d3cc420ace96d02a5b7e83d88cbd2e48010d5723`.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-191, CWE-125
References: https://github.com/nasa/CryptoLib/security/advisories/GHSA-q4v2-fvrv-qrf6
CVE: CVE-2025-2420
Published: 2025-03-17
Description: A vulnerability classified as problematic was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://gitee.com/morning-pro/Morning/issues/IBRVMX; https://vuldb.com/?ctiid.299917; https://vuldb.com/?id.299917
CVE: CVE-2025-2471
Published: 2025-03-18
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. Affected is an unknown function of the file /boat-details.php. The manipulation of the argument bid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/1cfh/vuln-pub/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.299964