deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2365
Published: 2025-03-17
Description: A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-610, CWE-611
References: https://github.com/jmx0hxq/Vulnerability-learning/blob/main/crmeb-java-xxe1.md; https://vuldb.com/?ctiid.299864; https://vuldb.com/?id.299864
CVE: CVE-2025-2366
Published: 2025-03-17
Description: A vulnerability, which was classified as problematic, was found in gougucms 4.08.18. This affects the function add of the file /admin/department/add of the component Add Department Page. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/caigo8/CVE-md/blob/main/gougucms/gougucms_v4.08.18_XSS.md; https://vuldb.com/?ctiid.299865; https://vuldb.com/?id.299865
CVE: CVE-2025-2367
Published: 2025-03-17
Description: A vulnerability has been found in Oiwtech OIW-2431APGN-HP 2.5.3-B20131128 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formScript of the component Personal Script Submenu. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://vuldb.com/?ctiid.299866; https://vuldb.com/?id.299866; https://vuldb.com/?submit.515126
CVE: CVE-2025-2368
Published: 2025-03-17
Description: A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/WebAssembly/wabt/issues/2537; https://github.com/WebAssembly/wabt/issues/2556; https://github.com/WebAssembly/wabt/issues/2556#issue[PII_REDACTED]
CVE: CVE-2025-2369
Published: 2025-03-17
Description: A vulnerability was found in TOTOLINK EX1800T up to 9.1.0cu.2112_B20220316. It has been classified as critical. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument admpass leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/Stack-based%20Buffer%20Overflow%2002%20setPasswordCfg-_admpass.md; https://vuldb.com/?ctiid.299868; https://vuldb.com/?id.299868
CVE: CVE-2025-2370
Published: 2025-03-17
Description: A vulnerability was found in TOTOLINK EX1800T up to 9.1.0cu.2112_B20220316. It has been declared as critical. Affected by this vulnerability is the function setWiFiExtenderConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument apcliSsid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/Stack-based%20Buffer%20Overflow%2003%20setWiFiExtenderConfig-_apcliSsid.md; https://vuldb.com/?ctiid.299869; https://vuldb.com/?id.299869
CVE: CVE-2024-12971
Published: 2025-03-17
Description: Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2024-12992
Published: 2025-03-17
Description: Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. 

This issue affects Pandora FMS from 700 to 777.6

.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2025-2199
Published: 2025-03-17
Description: SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query in ‘searchActionsToUpdate’, ‘searchSpecialitiesPending’, ‘searchSpecialitiesLinked’, ‘searchUsersToUpdateProfile’, ‘training_action_data’, ‘showContinuingTrainingCourses’ and ‘showUsersToEdit’ in /local/administration/ajax.php.
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-moodle-innovacion-y-cualificacion-plugins
CVE: CVE-2025-2200
Published: 2025-03-17
Description: SQL injection vulnerability in the IcProgreso Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query on the parameters user, id, idGroup, start_date and end_date in the endpoint /report/icprogreso/generar_blocks.php.
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-moodle-innovacion-y-cualificacion-plugins
CVE: CVE-2025-2201
Published: 2025-03-17
Description: Broken access control vulnerability in the IcProgress Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain sensitive information about other users such as public IP addresses, messages with other users and more.
CWE: CWE-863
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-moodle-innovacion-y-cualificacion-plugins
CVE: CVE-2025-2371
Published: 2025-03-17
Description: A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /registered-user-testing.php of the component Registered Mobile Number Search. The manipulation of the argument regmobilenumber leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/sorcha-l/cve/blob/main/Human%20Metapneumovirus%20(HMPV)%20%E2%80%93%20Testing%20Management%20System%20%20XSS%20in%20registered-user-testing.php.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.299870
CVE: CVE-2025-2372
Published: 2025-03-17
Description: A vulnerability classified as critical has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This affects an unknown part of the file /password-recovery.php of the component Password Recovery Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/SECWG/cve/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.299871
CVE: CVE-2025-2202
Published: 2025-03-17
Description: Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sensitive information about other users such as id, name, login and email.
CWE: CWE-863
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-moodle-innovacion-y-cualificacion-plugins
CVE: CVE-2025-2373
Published: 2025-03-17
Description: A vulnerability classified as critical was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This vulnerability affects unknown code of the file /check_availability.php. The manipulation of the argument mobnumber/employeeid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/SECWG/cve/issues/6; https://phpgurukul.com/; https://vuldb.com/?ctiid.299872
CVE: CVE-2025-2374
Published: 2025-03-17
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This issue affects some unknown processing of the file /profile.php. The manipulation of the argument aid/adminname/mobilenumber/email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/SECWG/cve/issues/7; https://phpgurukul.com/; https://vuldb.com/?ctiid.299873
CVE: CVE-2023-52316
Published: 2025-03-17
Description: Rejected reason: This CVE Record has been withdrawn by its CNA.
CVE: CVE-2023-52317
Published: 2025-03-17
Description: Rejected reason: This CVE Record has been withdrawn by its CNA.
CVE: CVE-2023-52318
Published: 2025-03-17
Description: Rejected reason: This CVE Record has been withdrawn by its CNA.
CVE: CVE-2023-52319
Published: 2025-03-17
Description: Rejected reason: This CVE Record has been withdrawn by its CNA.
CVE: CVE-2023-52320
Published: 2025-03-17
Description: Rejected reason: This CVE Record has been withdrawn by its CNA.
CVE: CVE-2023-52321
Published: 2025-03-17
Description: Rejected reason: This CVE Record has been withdrawn by its CNA.
CVE: CVE-2025-2375
Published: 2025-03-17
Description: A vulnerability, which was classified as problematic, was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected is an unknown function of the file /profile.php of the component Admin Profile Page. The manipulation of the argument email leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/SECWG/cve/issues/8; https://phpgurukul.com/; https://vuldb.com/?ctiid.299874
CVE: CVE-2025-2376
Published: 2025-03-17
Description: A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieContent of the file /src/UserRemember.php of the component PHP Object Handler. The manipulation of the argument cookieName leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-502
References: https://gist.github.com/mcdruid/1997e10026833d2d1f3e359d75b5912a; https://vuldb.com/?ctiid.299875; https://vuldb.com/?id.299875
CVE: CVE-2025-2377
Published: 2025-03-17
Description: A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /confirmbooking.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting product names.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Keyand/Multi-Restaurant-Table-Reservation-System-Search/blob/main/Vehicle%20Management%20System%20confirmbooking.php%20has%20Cross-site%20Scripting%20(XSS).pdf; https://vuldb.com/?ctiid.299876; https://vuldb.com/?id.299876
CVE: CVE-2025-2378
Published: 2025-03-17
Description: A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been classified as critical. This affects an unknown part of the file /download-medical-cards.php. The manipulation of the argument searchdata leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/chenyihao-cyber/CVE/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.299877
CVE: CVE-2025-2401
Published: 2025-03-17
Description: Buffer overflow vulnerability in Immunity Debugger affecting version 1.85, its exploitation could allow a local attacker to execute arbitrary code, due to the lack of proper boundary checking.
CWE: CWE-119
References: https://www.incibe.es/en/incibe-cert/notices/aviso/buffer-overflow-immunity-debugger
CVE: CVE-2019-15706
Published: 2025-03-17
Description: An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below and FortiOS version 6.2.1 and below, version 6.0.8 and below, version 5.6.12 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS).
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.fortinet.com/psirt/FG-IR-19-223
CVE: CVE-2019-17659
Published: 2025-03-17
Description: A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user "tunneluser" by leveraging knowledge of the private key from another installation or a firmware image.
CVSS Score: 3.7 (LOW)
CWE: CWE-798
References: https://fortiguard.fortinet.com/psirt/FG-IR-19-296
CVE: CVE-2019-6697
Published: 2025-03-17
Description: An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname parameter of a DHCP packet under DHCP monitor page may allow an unauthenticated attacker in the same network as the FortiGate to perform a Stored Cross Site Scripting attack (XSS) by sending a crafted DHCP packet.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-19-184
CVE: CVE-2020-29010
Published: 2025-03-17
Description: An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by  executing "get vpn ssl monitor" from the CLI. The sensitive data includes usernames, user groups, and IP address.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://fortiguard.fortinet.com/psirt/FG-IR-20-103
CVE: CVE-2020-9295
Published: 2025-03-17
Description: FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 running AV engine version 6.00137 and below may not immediately detect certain types of malformed or non-standard RAR archives, potentially containing malicious files. Based on the samples provided, FortiClient will detect the malicious files upon trying extraction by real-time scanning and FortiGate will detect the malicious archive if Virus Outbreak Prevention is enabled.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-358
References: https://fortiguard.com/psirt/FG-IR-20-037
CVE: CVE-2021-22126
Published: 2025-03-17
Description: A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2.7 to 8.2.6 may allow a local, authenticated attacker to connect to the managed Access Point (Meru AP and FortiAP-U) as root using the default hard-coded username and password.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284, CWE-798
References: https://fortiguard.fortinet.com/psirt/FG-IR-20-147
CVE: CVE-2021-26087
Published: 2025-03-17
Description: An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 web interface may allow both authenticated remote attackers and non-authenticated attackers in the same network as the appliance to perform a stored cross site scripting attack (XSS) via injecting malicious payloads in different locations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.fortinet.com/psirt/FG-IR-20-137
CVE: CVE-2021-32584
Published: 2025-03-17
Description: An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL.  The vulnerability applies only to limited CGI resources and might allow the unauthorized party to access configuration details.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://fortiguard.fortinet.com/psirt/FG-IR-20-138
CVE: CVE-2024-54027
Published: 2025-03-17
Description: A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access to read sensitive data via CLI.
CVSS Score: 8.2 (HIGH)
CWE: CWE-321
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-327
CVE: CVE-2024-9055
Published: 2025-03-17
Description: The DPA countermeasures on Silicon Labs' Series 2 devices are not reseeded periodically as they should be. This may allow an attacker to eventually extract secret keys through a DPA attack.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-331
References: https://community.silabs.com/069Vm00000LJMlfIAH
CVE: CVE-2025-0595
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0596
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0598
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0599
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0600
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0601
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0826
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0827
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0828
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0829
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0830
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Meeting Management in ENOVIA Change Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0832
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-0833
Published: 2025-03-17
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-27102
Published: 2025-03-17
Description: Agate is central authentication server software for OBiBa epidemiology applications. Prior to version 3.3.0, when registering for an Agate account, arbitrary HTML code can be injected into a user's first and last name. This HTML is then rendered in the email sent to administrative users. The Agate service account sends this email and appears trustworthy, making this a significant risk for phishing attacks. Administrative users are impacted, as they can be targeted by unauthenticated users. Version 3.3.0 fixes the issue.
CWE: CWE-79
References: https://github.com/obiba/agate/releases/tag/3.3.0; https://github.com/obiba/agate/security/advisories/GHSA-v3wj-7vj5-xj5v; https://github.com/obiba/agate/security/advisories/GHSA-v3wj-7vj5-xj5v