deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-9079
Published: 2025-09-19
Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://mattermost.com/security-updates
CVE: CVE-2025-9081
Published: 2025-09-19
Description: Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration
CVSS Score: 3.1 (LOW)
CWE: CWE-639
References: https://mattermost.com/security-updates
CVE: CVE-2025-43808
Published: 2025-09-19
Description: The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43808
CVE: CVE-2025-10652
Published: 2025-09-20
Description: The Robcore Netatmo plugin for WordPress is vulnerable to SQL Injection via the ‘module_id’ attribute of the robcore-netatmo shortcode in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/robcore-netatmo/tags/1.7/inc/class_robcore_netatmo.php#L3; https://plugins.trac.wordpress.org/browser/robcore-netatmo/tags/1.7/robcore-netatmo.php#L80; https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd383f1-0546-4ff2-9f93-ee9d48ac3053?source=cve
CVE: CVE-2025-10002
Published: 2025-09-20
Description: The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/3361848/clickwhale/trunk/includes/admin/Clickwhale_Ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d6eba6da-ac14-4914-a807-6e234b80ee71?source=cve
CVE: CVE-2025-10181
Published: 2025-09-20
Description: The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/dartiss/draft-list/blob/master/inc/create-lists.php; https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6/inc/create-lists.php#L339; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3363488%40simple-draft-list&new=3363488%40simple-draft-list&sfp_email=&sfph_mail=
CVE: CVE-2025-10305
Published: 2025-09-20
Description: The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_passkey() and passkeys_list() function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and delete passkeys.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3363280%40secure-passkeys&new=3363280%40secure-passkeys&sfp_email=&sfph_mail=#file2; https://www.wordfence.com/threat-intel/vulnerabilities/id/c41651ce-ee9b-408f-a25f-113d71beb935?source=cve
CVE: CVE-2025-10489
Published: 2025-09-20
Description: The SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more plugin for WordPress is vulnerable to unauthorized creation of forms due to a missing capability check on the register_post_types() function in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to create forms when the user interface specifically prohibits it.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3363914/sureforms/trunk/inc/post-types.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d03f316-542c-4128-b49d-fd2fd8609dd6?source=cve
CVE: CVE-2025-9949
Published: 2025-09-20
Description: The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the process_bulk_action() function. This makes it possible for unauthenticated attackers to delete SEO links via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362770%40seo-automated-link-building&new=3362770%40seo-automated-link-building&sfp_email=&sfph_mail=; https://wordpress.org/plugins/seo-automated-link-building/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e5e143-c4de-4312-8c8b-acf7ef60e0d5?source=cve
CVE: CVE-2025-10658
Published: 2025-09-20
Description: The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute forcing the 6-digit OTP code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307
References: https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/class-wpsc-current-user.php#L820; https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/models/class-wpsc-email-otp.php#L348; https://plugins.trac.wordpress.org/changeset/3364335/
CVE: CVE-2025-9882
Published: 2025-09-20
Description: The osTicket WP Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/osticket-wp-bridge/tags/1.9.2/admin/ost-config.php#L122; https://wordpress.org/plugins/osticket-wp-bridge/; https://www.wordfence.com/threat-intel/vulnerabilities/id/88e508ad-e7dd-4c8f-a44d-ef633e826007?source=cve
CVE: CVE-2025-9883
Published: 2025-09-20
Description: The Browser Sniff plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/browser-sniff/tags/2.3/browsersniff.php#L88; https://wordpress.org/plugins/browser-sniff/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b7210fd7-0812-47bc-bc62-d69280253e0a?source=cve
CVE: CVE-2025-9887
Published: 2025-09-20
Description: The Custom Login And Signup Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in the /frndzk_adminclsw.php file. This makes it possible for unauthenticated attackers to change the email and username settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/custom-login-and-signup-widget/tags/1.0/frndzk_adminclsw.php#L3; https://www.wordfence.com/threat-intel/vulnerabilities/id/f478db7f-6339-446e-b00d-0710707e679a?source=cve
CVE: CVE-2025-10741
Published: 2025-09-20
Description: A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Handler. The manipulation of the argument userAvatar leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://gist.github.com/KhanMarshaI/7a2e74fcb194f7d6ee7e60da4a14af7b; https://gist.github.com/KhanMarshaI/ba3e74b331ce4ab602a5a22a59aaf819; https://vuldb.com/?ctiid.325068
CVE: CVE-2025-40925
Published: 2025-09-20
Description: Starch versions 0.14 and earlier generate session ids insecurely.

The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.

Predicable session ids could allow an attacker to gain access to systems.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-338, CWE-340
References: https://github.com/bluefeet/Starch/commit/5573449e64e0660f7ee209d1eab5881d4ccbee3b.patch; https://github.com/bluefeet/Starch/pull/5; https://metacpan.org/dist/Starch/source/lib/Starch/Manager.pm
CVE: CVE-2025-10755
Published: 2025-09-20
Description: A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation of the argument userAvatar results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://gist.github.com/KhanMarshaI/7a2e74fcb194f7d6ee7e60da4a14af7b; https://vuldb.com/?ctiid.325069; https://vuldb.com/?id.325069
CVE: CVE-2024-10246
Published: 2025-09-20
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-10756
Published: 2025-09-20
Description: A security flaw has been discovered in UTT HiPER 840G up to 3.1.1-190328. Impacted is an unknown function of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/5.md; https://github.com/cymiao1978/cve/blob/main/5.md#poc; https://vuldb.com/?ctiid.325111
CVE: CVE-2025-10757
Published: 2025-09-21
Description: A weakness has been identified in UTT 1200GW up to 3.0.0-170831. The affected element is an unknown function of the file /goform/formConfigDnsFilterGlobal. This manipulation of the argument GroupName causes buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/6.md; https://github.com/cymiao1978/cve/blob/main/6.md#poc; https://vuldb.com/?ctiid.325112
CVE: CVE-2025-10758
Published: 2025-09-21
Description: A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the component Custom Field Handler. Such manipulation of the argument label leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.325113; https://vuldb.com/?id.325113; https://vuldb.com/?submit.645806
CVE: CVE-2025-10759
Published: 2025-09-21
Description: A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. The vendor explains: "As We are already aware about this vulnerability and our Internal team are already working on this issue. (...) We'll implement the fix for this vulnerability in our next major release."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-639, CWE-352, CWE-639
References: https://github.com/Ryomensukuna13/QloApps-Reusable-CSRF-Token-in-Logout-Functionality/blob/main/README.md; https://github.com/Ryomensukuna13/QloApps-Reusable-CSRF-Token-in-Logout-Functionality/blob/main/README.md#proof-of-concept-poc; https://vuldb.com/?ctiid.325114
CVE: CVE-2025-10760
Published: 2025-09-21
Description: A flaw has been found in Harness 3.3.0. This impacts the function LookupRepo of the file app/api/controller/gitspace/lookup_repo.go. Executing manipulation of the argument url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/August829/Yu/blob/main/58ead8e7e08bfb019.md; https://github.com/August829/Yu/blob/main/58ead8e7e08bfb019.md#poc; https://vuldb.com/?ctiid.325115
CVE: CVE-2025-10761
Published: 2025-09-21
Description: A vulnerability has been found in Harness 3.3.0. Affected is an unknown function of the file /api/v1/login of the component Login Endpoint. The manipulation leads to improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-307, CWE-799
References: https://github.com/August829/Yu/blob/main/58ead8e7e08bfb020.md; https://github.com/August829/Yu/blob/main/58ead8e7e08bfb020.md#poc; https://vuldb.com/?ctiid.325116
CVE: CVE-2025-10762
Published: 2025-09-21
Description: A vulnerability was found in kuaifan DooTask up to 1.2.49. Affected by this vulnerability is an unknown functionality of the file app/Http/Controllers/Api/UsersController.php. The manipulation of the argument keys[department] results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/kuaifan/dootask/issues/283; https://github.com/kuaifan/dootask/issues/283#issue[PII_REDACTED]; https://vuldb.com/?ctiid.325117
CVE: CVE-2025-10763
Published: 2025-09-21
Description: A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab. Affected by this issue is some unknown functionality of the file /edit-photo of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://gist.github.com/KhanMarshaI/86d0c1553355bb168084fffbdb6e7fea; https://vuldb.com/?ctiid.325118; https://vuldb.com/?id.325118
CVE: CVE-2025-10764
Published: 2025-09-21
Description: A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/August829/Yu/blob/main/58ead8e7e08bfb021.md; https://vuldb.com/?ctiid.325119; https://vuldb.com/?id.325119
CVE: CVE-2025-10765
Published: 2025-09-21
Description: A security flaw has been discovered in SeriaWei ZKEACMS up to 4.3. This vulnerability affects the function CheckPage/Suggestions in the library cms-v4.3\wwwroot\Plugins\ZKEACMS.SEOSuggestions\ZKEACMS.SEOSuggestions.dll of the component SEOSuggestions. Performing manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-918
References: https://github.com/wooyun123/wooyun/issues/1; https://vuldb.com/?ctiid.325120; https://vuldb.com/?id.325120
CVE: CVE-2025-10766
Published: 2025-09-21
Description: A weakness has been identified in SeriaWei ZKEACMS up to 4.3. This issue affects the function Download of the file EventViewerController.cs. Executing manipulation of the argument ID can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/August829/YU1/issues/1; https://vuldb.com/?ctiid.325121; https://vuldb.com/?id.325121
CVE: CVE-2025-6544
Published: 2025-09-21
Description: A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/h2oai/h2o-3/commit/0298ee348f5c73673b7b542158081e79605f5f25; https://huntr.com/bounties/53f35a0f-d644-4f82-93aa-89fe7e0aed40; https://huntr.com/bounties/53f35a0f-d644-4f82-93aa-89fe7e0aed40
CVE: CVE-2025-10768
Published: 2025-09-21
Description: A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/ez-lbz/poc/issues/50; https://github.com/ez-lbz/poc/issues/50#issue[PII_REDACTED]; https://vuldb.com/?ctiid.325124
CVE: CVE-2025-10769
Published: 2025-09-21
Description: A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connection_url leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/ez-lbz/poc/issues/51; https://github.com/ez-lbz/poc/issues/51#issue[PII_REDACTED]; https://huntr.com/bounties/4066ce21-7148-44f5-8336-b1674c2f588d
CVE: CVE-2025-53692
Published: 2025-09-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://chudypb.github.io/; https://labs.watchtowr.com/disclosed-vulnerabilities/; https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003734
CVE: CVE-2025-10767
Published: 2025-09-21
Description: A vulnerability was detected in CosmodiumCS OnlyRAT up to 3.2. The affected element is the function connect/remote_upload/remote_download of the file main.py of the component Configuration File Handler. The manipulation of the argument configuration["PASSWORD"] results in os command injection. The attack requires a local approach. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://docs.google.com/document/d/1oq9YO831FbEDBI2BqNiW-7YA_kMzHJmMgy82F8f-L9g/edit?usp=sharing; https://vuldb.com/?ctiid.325123; https://vuldb.com/?id.325123
CVE: CVE-2025-10770
Published: 2025-09-21
Description: A vulnerability was found in jeecgboot JimuReport up to 2.1.2. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the component MySQL JDBC Handler. Performing manipulation results in deserialization. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/jeecgboot/jimureport/issues/4116; https://github.com/jeecgboot/jimureport/issues/4116#issue[PII_REDACTED]; https://vuldb.com/?ctiid.325126
CVE: CVE-2025-10771
Published: 2025-09-21
Description: A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the component DB2 JDBC Handler. Executing manipulation of the argument clientRerouteServerListJNDIName can lead to deserialization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/jeecgboot/jimureport/issues/4117; https://github.com/jeecgboot/jimureport/issues/4117#issue[PII_REDACTED]; https://vuldb.com/?ctiid.325127