deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-36497
Published: 2021-10-22
Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`, `userid`, and `templet' parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2194; https://www.vulnerability-lab.com/get_content.php?id=2194
CVE: CVE-2020-36498
Published: 2021-10-22
Description: Macrob7 Macs Framework Content Management System - 1.14f contains a cross-site scripting (XSS) vulnerability in the account reset function, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the e-mail input field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2206; https://www.vulnerability-lab.com/get_content.php?id=2206
CVE: CVE-2020-36499
Published: 2021-10-22
Description: TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a cross-site scripting (XSS) vulnerability in the content parameter of the Rubric Block (Add) module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the rubric name value.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2215; https://www.vulnerability-lab.com/get_content.php?id=2215
CVE: CVE-2020-36501
Published: 2021-10-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2249; https://www.vulnerability-lab.com/get_content.php?id=2249
CVE: CVE-2020-36502
Published: 2021-10-22
Description: Swift File Transfer Mobile v1.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the devicename parameter which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered as the device name itself.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2205; https://www.vulnerability-lab.com/get_content.php?id=2205
CVE: CVE-2021-42258
Published: 2021-10-22
Description: BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware; https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42258
CVE: CVE-2021-21703
Published: 2021-10-25
Description: In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-787, CWE-787
References: http://www.openwall.com/lists/oss-security/2021/10/26/7; https://bugs.php.net/bug.php?id=81026; https://lists.debian.org/debian-lts-announce/2021/10/msg00021.html
CVE: CVE-2021-40371
Published: 2021-10-25
Description: Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\\ in a scriptName JSON value to ServiceManagerTenant/GetVisibilityMap.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://packetstormsecurity.com/files/164621/GridPro-Request-Management-For-Windows-Azure-Pack-2.0.7905-Directory-Traversal.html; http://seclists.org/fulldisclosure/2021/Oct/33; https://www.gridprosoftware.com/products/requestmanagement/
CVE: CVE-2021-40526
Published: 2021-10-25
Description: Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network server handling the Apple GymKit communication. This can lead to an Apple MFI device not being able to authenticate with the Peleton Bike
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-131
References: https://twitter.com/ROPsicle/status/[PII_REDACTED]03044107?s=20; https://twitter.com/ROPsicle/status/[PII_REDACTED]03044107?s=20
CVE: CVE-2021-40527
Published: 2021-10-25
Description: Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in plain text within the mobile application.
CVSS Score: 8.6 (HIGH)
CWE: CWE-312
References: https://twitter.com/ROPsicle/status/[PII_REDACTED]03044107?s=20; https://twitter.com/ROPsicle/status/[PII_REDACTED]03044107?s=20
CVE: CVE-2021-25977
Published: 2021-10-25
Description: In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/PiranhaCMS/piranha.core/commit/543bc53c7dbd28c793ec960b57fb0e716c6b18d7; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25977; https://github.com/PiranhaCMS/piranha.core/commit/543bc53c7dbd28c793ec960b57fb0e716c6b18d7
CVE: CVE-2021-35231
Published: 2021-10-25
Description: As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerable path: "Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kiwi Syslog Server\Parameters\Application".
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428, CWE-428
References: https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35231; https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm
CVE: CVE-2021-38294
Published: 2021-10-25
Description: A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-78
References: http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html; https://lists.apache.org/thread.html/r5fe881f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3E; https://seclists.org/oss-sec/2021/q4/44
CVE: CVE-2021-40865
Published: 2021-10-25
Description: An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E; https://seclists.org/oss-sec/2021/q4/45; https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
CVE: CVE-2017-20007
Published: 2021-10-25
Description: Ingeteam INGEPAC DA AU AUC_1.13.0.28 (and before) web application allows access to a certain path that contains sensitive information that could be used by an attacker to execute more sophisticated attacks. An unauthenticated remote attacker with access to the device´s web service could exploit this vulnerability in order to obtain different configuration files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.incibe-cert.es/en/early-warning/ics-advisories/information-exposure-ingepac-da-au; https://www.incibe-cert.es/en/early-warning/ics-advisories/information-exposure-ingepac-da-au
CVE: CVE-2020-14264
Published: 2021-10-25
Description: "HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"
CVSS Score: 3.9 (LOW)
CWE: CWE-327
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0092787; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0092787
CVE: CVE-2020-7859
Published: 2021-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2021-0409
Published: 2021-10-25
Description: In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561359; Issue ID: ALPS05561359.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0410
Published: 2021-10-25
Description: In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561360; Issue ID: ALPS05561360.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0411
Published: 2021-10-25
Description: In flv extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561362; Issue ID: ALPS05561362.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-190
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0412
Published: 2021-10-25
Description: In flv extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561366; Issue ID: ALPS05561366.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0413
Published: 2021-10-25
Description: In flv extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561379; Issue ID: ALPS05561379.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0414
Published: 2021-10-25
Description: In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561384; Issue ID: ALPS05561384.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0613
Published: 2021-10-25
Description: In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05489178; Issue ID: ALPS05489178.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0614
Published: 2021-10-25
Description: In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05495528; Issue ID: ALPS05495528.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0615
Published: 2021-10-25
Description: In flv extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561369; Issue ID: ALPS05561369.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-190
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0616
Published: 2021-10-25
Description: In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561389; Issue ID: ALPS05561389.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0617
Published: 2021-10-25
Description: In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561391; Issue ID: ALPS05561391.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0618
Published: 2021-10-25
Description: In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561394; Issue ID: ALPS05561394.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0625
Published: 2021-10-25
Description: In ccu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05594996; Issue ID: ALPS05594996.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0630
Published: 2021-10-25
Description: In wifi driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05551397; Issue ID: ALPS05551397.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0631
Published: 2021-10-25
Description: In wifi driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05551435; Issue ID: ALPS05551435.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0632
Published: 2021-10-25
Description: In wifi driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a proximal attacker under certain build conditions with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05560246; Issue ID: ALPS05551383.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0633
Published: 2021-10-25
Description: In display driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05585423; Issue ID: ALPS05585423.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0634
Published: 2021-10-25
Description: In display driver, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05594994; Issue ID: ALPS05594994.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-908
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0661
Published: 2021-10-25
Description: In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05844413; Issue ID: ALPS05844413.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0662
Published: 2021-10-25
Description: In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05844434; Issue ID: ALPS05844434.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0663
Published: 2021-10-25
Description: In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05844458; Issue ID: ALPS05844458.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2021; https://corp.mediatek.com/product-security-bulletin/October-2021
CVE: CVE-2021-0935
Published: 2021-10-25
Description: In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168607263References: Upstream kernel
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-10-01; https://source.android.com/security/bulletin/pixel/2021-10-01
CVE: CVE-2021-0936
Published: 2021-10-25
Description: In acc_read of f_accessory.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-173789633References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2021-10-01; https://source.android.com/security/bulletin/pixel/2021-10-01
CVE: CVE-2021-0938
Published: 2021-10-25
Description: In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-171418586References: Upstream kernel
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/pixel/2021-10-01; https://source.android.com/security/bulletin/pixel/2021-10-01
CVE: CVE-2021-0939
Published: 2021-10-25
Description: In set_default_passthru_cfg of passthru.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186026549References: N/A
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2021-10-01; https://source.android.com/security/bulletin/pixel/2021-10-01
CVE: CVE-2021-0940
Published: 2021-10-25
Description: In TBD of TBD, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-171315276References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2021-10-01; https://source.android.com/security/bulletin/pixel/2021-10-01
CVE: CVE-2021-0941
Published: 2021-10-25
Description: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References: Upstream kernel
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125, CWE-416
References: https://source.android.com/security/bulletin/pixel/2021-10-01; https://source.android.com/security/bulletin/pixel/2021-10-01
CVE: CVE-2021-24381
Published: 2021-10-25
Description: The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/e383fae6-e0da-4aba-bb62-adf51c01bf8d; https://wpscan.com/vulnerability/e383fae6-e0da-4aba-bb62-adf51c01bf8d