deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-47212
Published: 2025-04-03
Description: An issue was discovered in Iglu Server 0.13.0 and below. It involves sending very large payloads to a particular API endpoint of Iglu Server and can render it completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pipeline would eventually halt.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.snowplow.io/hc/en-us/articles/[PII_REDACTED]4909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE: CVE-2024-47213
Published: 2025-04-03
Description: An issue was discovered affecting Enrich 5.1.0 and below. It involves sending a maliciously crafted Snowplow event to the pipeline. Upon receiving this event and trying to validate it, Enrich crashes and attempts to restart indefinitely. As a result, event processing would be halted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://support.snowplow.io/hc/en-us/articles/[PII_REDACTED]4909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE: CVE-2024-47214
Published: 2025-04-03
Description: An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47212, but involves a different kind of malicious payload. As above, it can render Iglu Server completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pipeline would eventually halt.
CVSS Score: 7.5 (HIGH)
References: https://support.snowplow.io/hc/en-us/articles/[PII_REDACTED]4909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE: CVE-2024-47215
Published: 2025-04-03
Description: An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side. It involves attaching an invalid GTM SS preview header to events, causing them to be retried indefinitely. As a result, the performance of forwarding events to GTM SS overall can be affected (latency, throughput).
CVSS Score: 7.5 (HIGH)
CWE: CWE-703
References: https://support.snowplow.io/hc/en-us/articles/[PII_REDACTED]4909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE: CVE-2024-47217
Published: 2025-04-03
Description: An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47214, but involves an authenticated endpoint. It can render Iglu Server completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pipeline would eventually halt.
CVSS Score: 6.5 (MEDIUM)
References: https://support.snowplow.io/hc/en-us/articles/[PII_REDACTED]4909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE: CVE-2024-56528
Published: 2025-04-03
Description: This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits). It involves sending very large payloads to the Collector and can render it unresponsive to the rest of the requests. As a result, data would not enter the pipeline and would be potentially lost.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.snowplow.io/hc/en-us/articles/[PII_REDACTED]4909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE: CVE-2025-3178
Published: 2025-04-03
Description: A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /doctor/deleteappointment.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/12; https://vuldb.com/?ctiid.303137; https://vuldb.com/?id.303137
CVE: CVE-2025-3179
Published: 2025-04-03
Description: A vulnerability classified as critical has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected is an unknown function of the file /doctor/deletepatient.php. The manipulation of the argument ic leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/13; https://vuldb.com/?ctiid.303138; https://vuldb.com/?id.303138
CVE: CVE-2025-3180
Published: 2025-04-03
Description: A vulnerability classified as critical was found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /doctor/deleteschedule.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/14; https://vuldb.com/?ctiid.303139; https://vuldb.com/?id.303139
CVE: CVE-2025-0278
Published: 2025-04-03
Description: HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messages, debug logs, or responses to user requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120335
CVE: CVE-2025-0279
Published: 2025-04-03
Description: HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces.  Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120336
CVE: CVE-2025-30370
Published: 2025-04-03
Description: jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. This vulnerability is fixed in 0.51.1.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78
References: https://github.com/jupyterlab/jupyterlab-git/blob/7eb3b06f0092223bd5494688ec264527bbeb2195/src/commandsAndMenu.tsx#L175-L184; https://github.com/jupyterlab/jupyterlab-git/commit/b46482993f76d3a546015c6a94ebed8b77fc2376; https://github.com/jupyterlab/jupyterlab-git/pull/1196
CVE: CVE-2025-3181
Published: 2025-04-03
Description: A vulnerability, which was classified as critical, has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this issue is some unknown functionality of the file /patient/appointment.php?scheduleDate=1&appid=1. The manipulation of the argument scheduleDate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/15; https://vuldb.com/?ctiid.303140; https://vuldb.com/?id.303140
CVE: CVE-2025-3182
Published: 2025-04-03
Description: A vulnerability, which was classified as critical, was found in projectworlds Online Doctor Appointment Booking System 1.0. This affects an unknown part of the file /patient/getschedule.php. The manipulation of the argument q leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/16; https://vuldb.com/?ctiid.303141; https://vuldb.com/?id.303141
CVE: CVE-2025-3183
Published: 2025-04-03
Description: A vulnerability has been found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /patient/patientupdateprofile.php. The manipulation of the argument patientFirstName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/17; https://vuldb.com/?ctiid.303142; https://vuldb.com/?id.303142
CVE: CVE-2025-3184
Published: 2025-04-03
Description: A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This issue affects some unknown processing of the file /patient/profile.php?patientId=1. The manipulation of the argument patientFirstName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/18; https://vuldb.com/?ctiid.303143; https://vuldb.com/?id.303143
CVE: CVE-2025-3185
Published: 2025-04-03
Description: A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been classified as critical. Affected is an unknown function of the file /patient/patientupdateprofile.php. The manipulation of the argument patientFirstName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/19; https://vuldb.com/?ctiid.303144; https://vuldb.com/?id.303144
CVE: CVE-2025-3186
Published: 2025-04-04
Description: A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /patient/invoice.php. The manipulation of the argument appid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/20; https://vuldb.com/?ctiid.303145; https://vuldb.com/?id.303145
CVE: CVE-2025-25000
Published: 2025-04-04
Description: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25000
CVE: CVE-2025-25001
Published: 2025-04-04
Description: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25001
CVE: CVE-2025-29796
Published: 2025-04-04
Description: User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-451
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29796
CVE: CVE-2025-29815
Published: 2025-04-04
Description: Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
CVSS Score: 7.6 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29815
CVE: CVE-2025-3187
Published: 2025-04-04
Description: A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument logindetail leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/TiggerT/MyCVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.303146
CVE: CVE-2025-3188
Published: 2025-04-04
Description: A vulnerability classified as critical has been found in PHPGurukul e-Diary Management System 1.0. This affects an unknown part of the file /add-notes.php. The manipulation of the argument Category leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/TiggerT/MyCVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.303147
CVE: CVE-2025-24310
Published: 2025-04-04
Description: Improper restriction of rendered UI layers or frames issue exists in HMI ViewJet C-more series, which may allow a remote unauthenticated attacker to trick the product user to perform operations on the product's web pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://jvn.jp/en/jp/JVN17260367/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]71/
CVE: CVE-2025-24317
Published: 2025-04-04
Description: Allocation of resources without limits or throttling issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to cause a denial-of-service (DoS) condition.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://jvn.jp/en/jp/JVN17260367/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]69/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]71/
CVE: CVE-2025-25061
Published: 2025-04-04
Description: Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the product as an intermediary for FTP bounce attack.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-441
References: https://jvn.jp/en/jp/JVN17260367/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]69/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]71/
CVE: CVE-2025-26401
Published: 2025-04-04
Description: Weak encoding for password vulnerability exists in HMI ViewJet C-more series. If this vulnerability is exploited, authentication information may be obtained by a local authenticated attacker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-261
References: https://jvn.jp/en/jp/JVN17260367/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]71/
CVE: CVE-2025-3195
Published: 2025-04-04
Description: A vulnerability, which was classified as critical, has been found in itsourcecode Online Blood Bank Management System 1.0. This issue affects some unknown processing of the file /bbms.php. The manipulation of the argument Search leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/p1026/CVE/issues/21; https://itsourcecode.com/; https://vuldb.com/?ctiid.303149
CVE: CVE-2025-3196
Published: 2025-04-04
Description: A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/assimp/assimp/issues/6069; https://github.com/assimp/assimp/issues/6069#issuecomment[PII_REDACTED]; https://github.com/assimp/assimp/milestone/11
CVE: CVE-2025-3198
Published: 2025-04-04
Description: A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-401, CWE-404, CWE-401
References: https://sourceware.org/bugzilla/show_bug.cgi?id=32716; https://sourceware.org/bugzilla/show_bug.cgi?id=32716#c0; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344d
CVE: CVE-2025-3199
Published: 2025-04-04
Description: A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysModelController.java of the component API Interface. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.2 is able to address this issue. The name of the patch is c0daf641fb25b244591b7a6c3affa35c69d321fe. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-285
References: https://github.com/Tr0e/CVE_Hunter/blob/main/ruoyi-ai/ruoyi-ai_UnauthorizedAccess_01.md; https://github.com/ageerle/ruoyi-ai/issues/43; https://github.com/ageerle/ruoyi-ai/issues/43#issuecomment[PII_REDACTED]
CVE: CVE-2025-3202
Published: 2025-04-04
Description: A vulnerability classified as critical has been found in ageerle ruoyi-ai up to 2.0.0. Affected is an unknown function of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysNoticeController.java. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 6382e177bf90cc56ff[PII_REDACTED]9e35c50df32d. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-285
References: https://github.com/Tr0e/CVE_Hunter/blob/main/ruoyi-ai/ruoyi-ai_UnauthorizedAccess_02.md; https://github.com/ageerle/ruoyi-ai/commit/6382e177bf90cc56ff[PII_REDACTED]9e35c50df32d; https://github.com/ageerle/ruoyi-ai/issues/44#issue[PII_REDACTED]
CVE: CVE-2025-3203
Published: 2025-04-04
Description: A vulnerability classified as problematic was found in Tenda W18E 16.01.0.11. Affected by this vulnerability is the function formSetAccountList of the file /goform/setModules. The manipulation of the argument Password leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/ZIKH26/tmp_store_reports/blob/main/tenda-w18e.md; https://vuldb.com/?ctiid.303157; https://vuldb.com/?id.303157
CVE: CVE-2025-3204
Published: 2025-04-04
Description: A vulnerability, which was classified as critical, has been found in CodeAstro Car Rental System 1.0. Affected by this issue is some unknown functionality of the file /returncar.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/Lanxiy7th/lx_CVE_report-/issues/21; https://vuldb.com/?ctiid.303158
CVE: CVE-2025-3205
Published: 2025-04-04
Description: A vulnerability, which was classified as critical, was found in CodeAstro Student Grading System 1.0. This affects an unknown part of the file studentsubject.php. The manipulation of the argument studentId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/Lanxiy7th/lx_CVE_report-/issues/20; https://vuldb.com/?ctiid.303159
CVE: CVE-2025-3206
Published: 2025-04-04
Description: A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Lanxiy7th/lx_CVE_report-/issues/19; https://vuldb.com/?ctiid.303160
CVE: CVE-2025-3207
Published: 2025-04-04
Description: A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /birthing_form.php. The manipulation of the argument birth_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/[PII_REDACTED]/cve1/blob/main/README.md; https://vuldb.com/?ctiid.303161
CVE: CVE-2024-13744
Published: 2025-04-04
Description: The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset/3262569/woocommerce-jetpack/trunk/includes/input-fields/class-wcj-product-input-fields-core.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/f8e1aca8-3d82-4b1a-98c8-29501a377846?source=cve
CVE: CVE-2025-2075
Published: 2025-04-04
Description: The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3257300/uncanny-automator/trunk/src/core/classes/class-background-actions.php; https://plugins.trac.wordpress.org/changeset/3265280/uncanny-automator/trunk/src/core/classes/class-background-actions.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/86b4b0d6-bda2-47f3-a0b5-9733cb7a11f6?source=cve
CVE: CVE-2025-3191
Published: 2025-04-04
Description: All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tag.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/th4s1s/175ae4b[PII_REDACTED]b42377dd6c49d47; https://security.snyk.io/vuln/SNYK-JS-REACTDRAFTWYSIWYG-8515884; https://gist.github.com/th4s1s/175ae4b[PII_REDACTED]b42377dd6c49d47