deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-27264
Published: 2024-05-22
Description: IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call.  A malicious actor could cause user-controlled code to run with administrator privilege.  IBM X-Force ID:  284563.
CVSS Score: 7.4 (HIGH)
CWE: CWE-269, CWE-276, CWE-284
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/284563; https://www.ibm.com/support/pages/node/7154595; https://exchange.xforce.ibmcloud.com/vulnerabilities/284563
CVE: CVE-2024-31894
Published: 2024-05-22
Description: IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token.  IBM X-Force ID:  288175.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-324, CWE-672
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/288175; https://www.ibm.com/support/pages/node/7154606; https://exchange.xforce.ibmcloud.com/vulnerabilities/288175
CVE: CVE-2024-31895
Published: 2024-05-22
Description: IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token.  IBM X-Force ID:  288176.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-324, CWE-672
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/288176; https://www.ibm.com/support/pages/node/7154606; https://exchange.xforce.ibmcloud.com/vulnerabilities/288176
CVE: CVE-2024-4267
Published: 2024-05-22
Description: A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'open_file' function. An attacker can exploit this vulnerability by crafting a malicious file path that, when processed by the 'open_file' function, executes arbitrary system commands or reads sensitive file content. This issue is present in the code where subprocess.Popen is used unsafely to open files based on user-supplied paths without adequate validation, leading to potential command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://huntr.com/bounties/5a127724-cc13-4ea6-b81f-41546a7fff81; https://huntr.com/bounties/5a127724-cc13-4ea6-b81f-41546a7fff81
CVE: CVE-2024-4453
Published: 2024-05-22
Description: GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-23896.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://gitlab.freedesktop.org/tpm/gstreamer/-/commit/e68eccff103ab0e91e6d77a892f57131b33902f5; https://lists.debian.org/debian-lts-announce/2024/05/msg00019.html; https://www.zerodayinitiative.com/advisories/ZDI-24-467/
CVE: CVE-2024-4454
Published: 2024-05-22
Description: WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part of an administrator is required to exploit this vulnerability.

The specific flaw exists within the WithSecure plugin hosting service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23035.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-24-491/; https://www.zerodayinitiative.com/advisories/ZDI-24-491/
CVE: CVE-2023-46806
Published: 2024-05-22
Description: An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database.  
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-89
References: https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US; https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US
CVE: CVE-2023-46807
Published: 2024-05-22
Description: An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-89
References: https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US; https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US
CVE: CVE-2024-22026
Published: 2024-05-22
Description: A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284
References: https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US; https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US
CVE: CVE-2024-29849
Published: 2024-05-22
Description: Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://veeam.com/kb4581; https://veeam.com/kb4581
CVE: CVE-2024-29850
Published: 2024-05-22
Description: Veeam Backup Enterprise Manager allows account takeover via NTLM relay.
CVSS Score: 8.8 (HIGH)
CWE: CWE-294
References: https://veeam.com/kb4581; https://veeam.com/kb4581
CVE: CVE-2024-29851
Published: 2024-05-22
Description: Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.
CVSS Score: 7.2 (HIGH)
CWE: CWE-294
References: https://veeam.com/kb4581; https://veeam.com/kb4581
CVE: CVE-2024-29852
Published: 2024-05-22
Description: Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.
CVSS Score: 2.7 (LOW)
CWE: CWE-280
References: https://veeam.com/kb4581; https://veeam.com/kb4581
CVE: CVE-2024-29853
Published: 2024-05-22
Description: An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-288
References: https://veeam.com/kb4582; https://veeam.com/kb4582
CVE: CVE-2024-3708
Published: 2024-05-23
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-6844
Published: 2024-05-23
Description: The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to and including 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/iframe/trunk/iframe.php#L37; https://plugins.trac.wordpress.org/browser/iframe/trunk/iframe.php#L60; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3089839%40iframe%2Ftrunk&old=3036990%40iframe%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-1855
Published: 2024-05-23
Description: The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.23 via the wpc_check_for_submission function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://plugins.trac.wordpress.org/browser/wp-cafe/trunk/core/action/wpc-ajax-action.php#L76; https://plugins.trac.wordpress.org/changeset/3084054/wp-cafe/trunk/core/action/wpc-ajax-action.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/5f83c19e-1b75-4fea-b4de-f7f844a449c0?source=cve
CVE: CVE-2024-3065
Published: 2024-05-23
Description: The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE-2024-5447 may be a duplicate of this issue.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/paypal-pay-buy-donation-and-cart-buttons-shortcode/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c596c278-4f16-4830-8e6e-5e1392d4d118?source=cve; https://wordpress.org/plugins/paypal-pay-buy-donation-and-cart-buttons-shortcode/
CVE: CVE-2024-3201
Published: 2024-05-23
Description: The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pp_link' shortcode in all versions up to, and including, 3.1.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3090019%40shapepress-dsgvo%2Ftrunk&old=3016389%40shapepress-dsgvo%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/df5cd6e7-e821-403f-a048-25c2ca1fb2de?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3090019%40shapepress-dsgvo%2Ftrunk&old=3016389%40shapepress-dsgvo%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-4486
Published: 2024-05-23
Description: The Awesome Contact Form7 for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'AEP Contact Form 7' widget in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/awesome-contact-form7-for-elementor/trunk/widgets/aep-contact-form7.php#L819; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3091511%40awesome-contact-form7-for-elementor%2Ftrunk&old=3006173%40awesome-contact-form7-for-elementor%2Ftrunk&sfp_email=&sfph_mail=#file4; https://www.wordfence.com/threat-intel/vulnerabilities/id/0687e101-3c96-4c9b-941a-1b0fed2f76e2?source=cve
CVE: CVE-2024-4783
Published: 2024-05-23
Description: The jQuery T(-) Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and including, 2.3.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 	CVE-2024-37247 may be a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/jquery-t-countdown-widget/trunk/countdown-timer.php#L768; https://www.wordfence.com/threat-intel/vulnerabilities/id/78eeef12-123b-42f6-b446-c3f2d43153fd?source=cve; https://plugins.trac.wordpress.org/browser/jquery-t-countdown-widget/trunk/countdown-timer.php#L768
CVE: CVE-2024-4978
Published: 2024-05-23
Description: Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.
CVSS Score: 8.4 (HIGH)
CWE: CWE-506
References: https://twitter.com/2RunJack2/status/[PII_REDACTED]66377148; https://www.javs.com/downloads/; https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/
CVE: CVE-2024-5230
Published: 2024-05-23
Description: A vulnerability has been found in EnvaySoft FleetCart up to 4.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument razorpayKeyId leads to information disclosure. The attack can be launched remotely. It is recommended to upgrade the affected component. The identifier VDB-265981 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://vuldb.com/?ctiid.265981; https://vuldb.com/?id.265981; https://vuldb.com/?submit.333519
CVE: CVE-2024-4895
Published: 2024-05-23
Description: The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CSV import functionality in all versions up to, and including, 3.4.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3089897/; https://wordpress.org/plugins/wpdatatables/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/0c944e08-1b70-4b56-80eb-f588c0fab5b6?source=cve
CVE: CVE-2024-5231
Published: 2024-05-23
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view/teacher_salary_details.php. The manipulation of the argument index leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-265982 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2021.pdf; https://vuldb.com/?ctiid.265982; https://vuldb.com/?id.265982
CVE: CVE-2024-4431
Published: 2024-05-23
Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.3.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/lastudio-element-kit/trunk/templates/advanced-carousel/global/simple/items-loop-end.php#L7; https://plugins.trac.wordpress.org/browser/lastudio-element-kit/trunk/templates/banner-list/global/index.php#L75; https://plugins.trac.wordpress.org/browser/lastudio-element-kit/trunk/templates/images-layout/global/index.php#L75
CVE: CVE-2024-5232
Published: 2024-05-23
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. This affects an unknown part of the file /view/teacher_salary_details2.php. The manipulation of the argument index leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265983.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2022.pdf; https://vuldb.com/?ctiid.265983; https://vuldb.com/?id.265983
CVE: CVE-2023-6325
Published: 2024-05-23
Description: The RomethemeForm For Elementor plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the export_entries, rtformnewform, and rtformupdate functions in all versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to export arbitrary form submissions, create new forms, or update any post title or certain metadata.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/romethemeform/tags/1.1.2/modules/form/form.php; https://plugins.trac.wordpress.org/changeset/3090708/romethemeform/trunk?contextall=1&old=3079080&old_path=%2Fromethemeform%2Ftrunk; https://www.wordfence.com/threat-intel/vulnerabilities/id/81a293ea-abda-4c90-a109-791ca5ba89a4?source=cve
CVE: CVE-2024-4662
Published: 2024-05-23
Description: The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to inject arbitrary PHP code via the WordPress user interface and gain elevated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://oxygenbuilder.com/oxygen-4-8-3-now-available-security-update/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8706c3f6-64e0-440e-a802-5c80d9cc3643?source=cve; https://oxygenbuilder.com/oxygen-4-8-3-now-available-security-update/
CVE: CVE-2024-5233
Published: 2024-05-23
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view/teacher_salary_details3.php. The manipulation of the argument index leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265984.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2023.pdf; https://vuldb.com/?ctiid.265984; https://vuldb.com/?id.265984
CVE: CVE-2024-5234
Published: 2024-05-23
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /view/teacher_salary_history1.php. The manipulation of the argument index leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265985 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2024.pdf; https://vuldb.com/?ctiid.265985; https://vuldb.com/?id.265985
CVE: CVE-2024-5235
Published: 2024-05-23
Description: A vulnerability classified as critical has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file /view/teacher_salary_invoice.php. The manipulation of the argument teacher_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-265986 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2025.pdf; https://vuldb.com/?ctiid.265986; https://vuldb.com/?id.265986
CVE: CVE-2024-5236
Published: 2024-05-23
Description: A vulnerability classified as critical was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view/teacher_salary_invoice1.php. The manipulation of the argument date leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265987.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2026.pdf; https://vuldb.com/?ctiid.265987; https://vuldb.com/?id.265987
CVE: CVE-2024-2220
Published: 2024-05-23
Description: The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fe8c001e-8880-4570-b010-a41fc8ee0c58/; https://wpscan.com/vulnerability/fe8c001e-8880-4570-b010-a41fc8ee0c58/
CVE: CVE-2024-3594
Published: 2024-05-23
Description: The IDonate  WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7a8a834a-e5d7-4678-9d35-4390d1200437/; https://wpscan.com/vulnerability/7a8a834a-e5d7-4678-9d35-4390d1200437/
CVE: CVE-2024-3626
Published: 2024-05-23
Description: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_template_content function in all versions up to, and including, 5.7.17. This makes it possible for authenticated attackers, with subscriber access and above, to obtain the contents of private and password-protected posts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/admin/class-email-subscribers-admin.php#L849; https://plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/includes/class-email-subscribers.php#L1063; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3072302%40email-subscribers%2Ftrunk&old=3069441%40email-subscribers%2Ftrunk&sfp_email=&sfph_mail=