deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13959
Published: 2025-05-09
Description: Link Following Local Privilege Escalation Vulnerability in TuneupSvc.exe in AVG TuneUp 24.2.16593.9844 on Windows allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging the service to delete a directory
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE: CVE-2024-13960
Published: 2025-05-09
Description: Link Following Local Privilege Escalation Vulnerability in TuneUp Service in AVG TuneUp Version 23.4 (build 15592) on Windows 10 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-367
References: https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE: CVE-2024-13961
Published: 2025-05-09
Description: Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-367
References: https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE: CVE-2024-13962
Published: 2025-05-09
Description: Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Gen Digital Inc. Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE: CVE-2024-9524
Published: 2025-05-09
Description: Link Following Local Privilege Escalation Vulnerability in System Speedup Service in Avira Operations GmbH Avira Prime Version 1.1.96.2 on Windows 10 x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE: CVE-2025-28200
Published: 2025-05-09
Description: Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: http://rx1800.com; http://victure.com; https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router/
CVE: CVE-2025-28201
Published: 2025-05-09
Description: An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router/
CVE: CVE-2025-28202
Published: 2025-05-09
Description: Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router/
CVE: CVE-2025-28203
Published: 2025-05-09
Description: Victure RX1800 EN_V1.0.0_r12_110933 was discovered to contain a command injection vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router/
CVE: CVE-2025-45513
Published: 2025-05-09
Description: Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.P2pListFilter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://github.com/Eu21ka/cve_report/blob/master/The%20router%20Tenda%20FH451%20V1.0.0.9%20of%20Shenzhen%20Jixiang%20Tenda%20Technology%20Co.%2C%20Ltd.%20has%20a%20stack%20overflow%20vulnerability.md
CVE: CVE-2025-46188
Published: 2025-05-09
Description: SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in superadmin_phpmyadmin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/x6vrn/mitre/blob/main/CVE-2025-46188.md; https://medium.com/@bijay.kumar1857/sql-injection-to-rce-exploitation-0a5048e592be
CVE: CVE-2025-46189
Published: 2025-05-09
Description: SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_order_customer_update.php via the order_id POST parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/x6vrn/mitre/blob/main/CVE-2025-46189.md; https://medium.com/@YousefAlotaibi/disclaimer-1699f46cb1a0
CVE: CVE-2025-46193
Published: 2025-05-09
Description: SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in user_proposal_update_order.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/x6vrn/mitre/blob/main/CVE-2025-46193.md; https://portswigger.net/web-security/file-upload
CVE: CVE-2025-4432
Published: 2025-05-09
Description: A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://access.redhat.com/security/cve/CVE-2025-4432; https://bugzilla.redhat.com/show_bug.cgi?id=2350655; https://github.com/briansmith/ring
CVE: CVE-2024-8973
Published: 2025-05-09
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. It was possible to cause a DoS condition via GitHub import requests using a malicious crafted payload.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/491041; https://hackerone.com/reports/2711684
CVE: CVE-2025-0549
Published: 2025-05-09
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. A security vulnerability allows attackers to bypass Device OAuth flow protections, enabling authorization form submission through minimal user interaction.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-288
References: https://gitlab.com/gitlab-org/gitlab/-/issues/513996; https://hackerone.com/reports/2927555
CVE: CVE-2025-1278
Published: 2025-05-09
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1220
References: https://gitlab.com/gitlab-org/gitlab/-/issues/519580; https://hackerone.com/reports/2977149
CVE: CVE-2025-29509
Published: 2025-05-09
Description: Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external website in the app and the exposure of electronAPI, with a lack of filtering of URL when calling shell.openExternal().
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://drive.google.com/file/d/1qDztNtn2merSjYgPRLWFFXqlXM9tcrjD/view?usp=sharing; https://gist.github.com/Suuuuuzy/b8fa2fa083793c460e3686c182f8c4d1
CVE: CVE-2025-46190
Published: 2025-05-09
Description: SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_delivery_update.php via the order_id POST parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/x6vrn/mitre/blob/main/CVE-2025-46190.md; https://www.invicti.com/learn/blind-sql-injection/
CVE: CVE-2025-46191
Published: 2025-05-09
Description: Arbitrary File Upload in user_payment_update.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploaded_file_cancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attackers can upload executable PHP files to a web-accessible directory (/files/). This allows them to execute arbitrary commands remotely by accessing the uploaded script, resulting in full Remote Code Execution (RCE) without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/x6vrn/mitre/blob/main/CVE-2025-46191.md; https://portswigger.net/web-security/file-upload
CVE: CVE-2025-46192
Published: 2025-05-09
Description: SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_payment_update.php via the order_id POST parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/x6vrn/mitre/blob/main/CVE-2025-46192.md; https://www.invicti.com/learn/blind-sql-injection/
CVE: CVE-2025-4480
Published: 2025-05-09
Description: A vulnerability was found in code-projects Simple College Management System 1.0. It has been declared as critical. This vulnerability affects the function input of the component Add New Student. The manipulation of the argument name/branch leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/SIMPLE_COLLEGE_MANAGEMENT_SYSTEM.md; https://vuldb.com/?ctiid.308194
CVE: CVE-2025-4481
Published: 2025-05-09
Description: A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /search-result.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/hackerzhuo/CVE/issues/1; https://vuldb.com/?ctiid.308195; https://vuldb.com/?id.308195
CVE: CVE-2025-1993
Published: 2025-05-09
Description: IBM App Connect Enterprise Certified Container 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7, 12.8, 12.9, and 12.10 DesignerAuthoring instances store their flows in a database that is protected by weaker than expected cryptographic algorithms that could be decrypted by a local user.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-521, CWE-521
References: https://www.ibm.com/support/pages/node/7233054
CVE: CVE-2025-4482
Published: 2025-05-09
Description: A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0. Affected by this vulnerability is an unknown functionality of the file /change_pass/forgot_password_sql.php. The manipulation of the argument Pat_BloodGroup1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/hhhanxx/attack/issues/3; https://vuldb.com/?ctiid.308197; https://vuldb.com/?id.308197
CVE: CVE-2025-4483
Published: 2025-05-09
Description: A vulnerability, which was classified as critical, has been found in itsourcecode Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /view_pdetails.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.308198
CVE: CVE-2025-4484
Published: 2025-05-09
Description: A vulnerability, which was classified as critical, was found in itsourcecode Gym Management System 1.0. This affects an unknown part of the file /ajax.php?action=delete_user. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/4; https://itsourcecode.com/; https://vuldb.com/?ctiid.308199
CVE: CVE-2025-4485
Published: 2025-05-09
Description: A vulnerability has been found in itsourcecode Gym Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=delete_trainer. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/5; https://itsourcecode.com/; https://vuldb.com/?ctiid.308200
CVE: CVE-2025-4486
Published: 2025-05-09
Description: A vulnerability was found in itsourcecode Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.php?action=delete_plan. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/6; https://itsourcecode.com/; https://vuldb.com/?ctiid.308201
CVE: CVE-2025-4487
Published: 2025-05-09
Description: A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?action=delete_member. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/7; https://itsourcecode.com/; https://vuldb.com/?ctiid.308202
CVE: CVE-2025-4488
Published: 2025-05-09
Description: A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_package. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/8; https://itsourcecode.com/; https://vuldb.com/?ctiid.308203
CVE: CVE-2025-47269
Published: 2025-05-09
Description: code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to an arbitrary domain. The malicious URL `https://<code-server>/proxy/test@evil.com/path` would be proxied to `test@evil.com/path` where the attacker could exfiltrate a user's session token. Any user who runs code-server with the built-in proxy enabled and clicks on maliciously crafted links that go to their code-server instances with reference to /proxy. Normally this is used to proxy local ports, however the URL can reference the attacker's domain instead, and the connection is then proxied to that domain, which will include sending cookies. With access to the session cookie, the attacker can then log into code-server and have full access to the machine hosting code-server as the user running code-server. This issue has been patched in version 4.99.4.
CVSS Score: 8.3 (HIGH)
CWE: CWE-441
References: https://github.com/coder/code-server/commit/47d6d3ada5aadef6d221f3d612401eb3dad9299e; https://github.com/coder/code-server/releases/tag/v4.99.4; https://github.com/coder/code-server/security/advisories/GHSA-p483-wpfp-42cj
CVE: CVE-2025-4447
Published: 2025-05-09
Description: In Eclipse OpenJ9 versions up to 0.51, when used with OpenJDK version 8 a stack based buffer overflow can be caused by modifying a file on disk that is read when the JVM starts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://github.com/eclipse-openj9/openj9/pull/21762; https://gitlab.eclipse.org/security/cve-assignement/-/issues/61
CVE: CVE-2025-4489
Published: 2025-05-09
Description: A vulnerability was found in Campcodes Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /routers/user-router.php. The manipulation of the argument t1_verified leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/9; https://vuldb.com/?ctiid.308204; https://vuldb.com/?id.308204
CVE: CVE-2025-4490
Published: 2025-05-09
Description: A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. This affects an unknown part of the file /view-ticket-admin.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/10; https://vuldb.com/?ctiid.308205; https://vuldb.com/?id.308205
CVE: CVE-2025-4491
Published: 2025-05-09
Description: A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /routers/ticket-status.php. The manipulation of the argument ticket_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/11; https://vuldb.com/?ctiid.308206; https://vuldb.com/?id.308206
CVE: CVE-2025-4492
Published: 2025-05-09
Description: A vulnerability, which was classified as critical, has been found in Campcodes Online Food Ordering System 1.0. This issue affects some unknown processing of the file /routers/ticket-message.php. The manipulation of the argument ticket_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/12; https://vuldb.com/?ctiid.308207; https://vuldb.com/?id.308207
CVE: CVE-2025-4494
Published: 2025-05-09
Description: A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0. Affected is the function toLogin of the file NoNeedLoginController.java of the component Admin Backend. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/JAdmin-JAVA/JAdmin/issues/1; https://github.com/JAdmin-JAVA/JAdmin/issues/1#issue[PII_REDACTED]; https://vuldb.com/?ctiid.308208
CVE: CVE-2025-3794
Published: 2025-05-09
Description: The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.4.2/assets/js/frontend/wpforms.js#L3154; https://www.wordfence.com/threat-intel/vulnerabilities/id/179eb680-e8d8-4918-96e3-e67217771c29?source=cve
CVE: CVE-2025-47424
Published: 2025-05-09
Description: Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated.
CVSS Score: 7.1 (HIGH)
CWE: CWE-348
References: https://docs.retool.com/disclosures/cve-2025-47424
CVE: CVE-2025-4495
Published: 2025-05-10
Description: A vulnerability has been found in JAdmin-JAVA JAdmin 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /memoAjax/save. The manipulation of the argument ID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/JAdmin-JAVA/JAdmin/issues/2; https://github.com/JAdmin-JAVA/JAdmin/issues/2#issue[PII_REDACTED]; https://vuldb.com/?ctiid.308209
CVE: CVE-2025-1137
Published: 2025-05-10
Description: IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neutralization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-250
References: https://www.ibm.com/support/pages/node/7233085
CVE: CVE-2025-4496
Published: 2025-05-10
Description: A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/1.md; https://vuldb.com/?ctiid.308212; https://vuldb.com/?id.308212
CVE: CVE-2025-2944
Published: 2025-05-10
Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up to, and including, 2.6.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3290315/; https://wordpress.org/plugins/jeg-elementor-kit/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/7baa8cca-96a5-4d6b-86d5-53cd1a4675cf?source=cve
CVE: CVE-2025-4497
Published: 2025-05-10
Description: A vulnerability was found in code-projects Simple Banking System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the component Sign In. The manipulation of the argument password2 leads to buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120, CWE-120
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/Banking_System.md; https://vuldb.com/?ctiid.308213