deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-39797
Published: 2025-09-12
Description: In the Linux kernel, the following vulnerability has been resolved:

xfrm: Duplicate SPI Handling

The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI
Netlink message, which triggers the kernel function xfrm_alloc_spi().
This function is expected to ensure uniqueness of the Security Parameter
Index (SPI) for inbound Security Associations (SAs). However, it can
return success even when the requested SPI is already in use, leading
to duplicate SPIs assigned to multiple inbound SAs, differentiated
only by their destination addresses.

This behavior causes inconsistencies during SPI lookups for inbound packets.
Since the lookup may return an arbitrary SA among those with the same SPI,
packet processing can fail, resulting in packet drops.

According to RFC 4301 section 4.4.2 , for inbound processing a unicast SA
is uniquely identified by the SPI and optionally protocol.

Reproducing the Issue Reliably:
To consistently reproduce the problem, restrict the available SPI range in
charon.conf : spi_min = 0x10000000 spi_max = 0x10000002
This limits the system to only 2 usable SPI values.
Next, create more than 2 Child SA. each using unique pair of src/dst address.
As soon as the 3rd Child SA is initiated, it will be assigned a duplicate
SPI, since the SPI pool is already exhausted.
With a narrow SPI range, the issue is consistently reproducible.
With a broader/default range, it becomes rare and unpredictable.

Current implementation:
xfrm_spi_hash() lookup function computes hash using daddr, proto, and family.
So if two SAs have the same SPI but different destination addresses, then
they will:
a. Hash into different buckets
b. Be stored in different linked lists (byspi + h)
c. Not be seen in the same hlist_for_each_entry_rcu() iteration.
As a result, the lookup will result in NULL and kernel allows that Duplicate SPI

Proposed Change:
xfrm_state_lookup_spi_proto() does a truly global search - across all states,
regardless of hash bucket and matches SPI and proto.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/29e9158f91f99057dbd35db5e8674d93b38549fe; https://git.kernel.org/stable/c/2fc5b54368a1bf1d2d74b4d3b8eea5309a653e38; https://git.kernel.org/stable/c/3d8090bb53424432fa788fe9a49e8ceca74f0544
CVE: CVE-2025-39798
Published: 2025-09-12
Description: In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix the setting of capabilities when automounting a new filesystem

Capabilities cannot be inherited when we cross into a new filesystem.
They need to be reset to the minimal defaults, and then probed for
again.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/175afda783e38c0660f2afc0602dd9c83d4e7ee1; https://git.kernel.org/stable/c/3924dab90816d0c683a110628ef386f83a9d1e13; https://git.kernel.org/stable/c/50e0fd0050e510e749e1fdd1d7158e419ff8f3b9
CVE: CVE-2025-39799
Published: 2025-09-12
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-55835
Published: 2025-09-12
Description: File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://sueamcms.com; http://www.sueamcms.com; https://github.com/Utainlab/Vulns/blob/main/CVE-2025-55835.txt
CVE: CVE-2025-57577
Published: 2025-09-12
Description: An issue in H3C Device R365V300R004 allows a remote attacker to execute arbitrary code via the default password. NOTE: the Supplier's position is that their "product lines enforce or clearly prompt users to change any initial credentials upon first use. At most, this would be a case of misconfiguration if an administrator deliberately ignored the prompts, which is outside the scope of CVE definitions."
CVSS Score: 8.0 (HIGH)
CWE: CWE-798
References: https://github.com/XXRicardo/iot-cve/blob/main/H3C/R365V300R004.md; https://h3c.com; https://www.h3c.com/cn/
CVE: CVE-2025-57578
Published: 2025-09-12
Description: An issue in H3C Magic M Device M2V100R006 allows a remote attacker to execute arbitrary code via the default password
CVSS Score: 8.0 (HIGH)
CWE: CWE-798
References: https://github.com/XXRicardo/iot-cve/blob/main/H3C/M2V100R006.md
CVE: CVE-2025-57579
Published: 2025-09-12
Description: An issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote attacker to execute arbitrary code via the default password
CVSS Score: 8.0 (HIGH)
CWE: CWE-798
References: https://github.com/XXRicardo/iot-cve/blob/main/TOLOLINK/X2000R-Gh-V2.0.0.md; https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/259/ids/36.html
CVE: CVE-2024-45431
Published: 2025-09-12
Description: OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of proper validation of remote L2CAP channel ID (CID). An attacker can leverage this to create an L2CAP channel with the null identifier assigned as a remote CID.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://pcacybersecurity.com/resources/advisory/perfekt-blue; https://www.opensynergy.com/
CVE: CVE-2024-45432
Published: 2025-09-12
Description: OpenSynergy BlueSDK (aka Blue SDK) through 6.x mishandles a function call. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from an incorrect variable used as a function argument. An attacker can leverage this to cause unexpected behavior or obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://pcacybersecurity.com/resources/advisory/perfekt-blue; https://www.opensynergy.com/
CVE: CVE-2024-45433
Published: 2025-09-12
Description: OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Incorrect Control Flow Scoping. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of proper return control flow after detecting an unusual condition. An attacker can leverage this to bypass a security validation and make the incoming data be processed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-705
References: https://pcacybersecurity.com/resources/advisory/perfekt-blue; https://www.opensynergy.com/
CVE: CVE-2024-45434
Published: 2025-09-12
Description: OpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of validating the existence of an object before performing operations on the object (aka use after free). An attacker can leverage this to achieve remote code execution in the context of a user account under which the Bluetooth process runs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://pcacybersecurity.com/resources/advisory/perfekt-blue; https://www.opensynergy.com/; https://pcacybersecurity.com/resources/advisory/perfekt-blue
CVE: CVE-2025-43787
Published: 2025-09-12
Description: A Stored cross-site scripting vulnerability in the Liferay Portal  7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the organization site names. The malicious payload is stored and executed without proper sanitization or escaping.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43787
CVE: CVE-2025-52074
Published: 2025-09-12
Description: PHPGURUKUL Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) due to lack of input sanitization in the quantity parameter when adding a product to the cart.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/NullMinds/CVE-Hunting/blob/main/Online%20Shopping%20Portal/Stored%20XSS%20in%20Quantity%20Parameter.pdf
CVE: CVE-2025-56467
Published: 2025-09-12
Description: An issue was discovered in AXIS BANK LIMITED Axis Mobile App 9.9 that allows attackers to obtain sensitive information without a UPI PIN, such as account information, balances, transaction history, and unspecified other information. NOTE: the Supplier's perspective is that this is an intended feature and "does not reveal much sensitive information."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://axis.com; https://github.com/dewcode91/security-research/blob/main/CVE-2025-56467.md; https://github.com/dewcode91/security-research/blob/main/CVE-2025-56467.mdhttps://github.com/dewcode91/security-research/blob/main/CVE-2025-56467.md
CVE: CVE-2025-10321
Published: 2025-09-12
Description: A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is an unknown function of the file /live_online.shtml. Executing manipulation can lead to information disclosure. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/live_online.shtml; https://vuldb.com/?ctiid.323747; https://vuldb.com/?id.323747
CVE: CVE-2025-10322
Published: 2025-09-12
Description: A vulnerability has been found in Wavlink WL-WN578W2 221110. The affected element is an unknown function of the file /sysinit.html. The manipulation of the argument newpass/confpass leads to weak password recovery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-640
References: https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/sysinit.html; https://vuldb.com/?ctiid.323748; https://vuldb.com/?id.323748
CVE: CVE-2025-4234
Published: 2025-09-12
Description: A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.
CWE: CWE-532
References: https://security.paloaltonetworks.com/CVE-2025-4234
CVE: CVE-2025-4235
Published: 2025-09-12
Description: An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the service account password under specific non-default configurations. This allows an unprivileged Domain User to escalate privileges by exploiting the account’s permissions. The impact varies by configuration:
  *  Minimally Privileged Accounts: Enable disruption of User-ID Credential Agent operations (e.g., uninstalling or disabling the agent service), weakening network security policies that leverage  Credential Phishing Prevention https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention  under a  Domain Credential Filter https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention/methods-to-check-for-corporate-credential-submissions  configuration.
  *  Elevated Accounts (Server Operator, Domain Join, Legacy Features): Permit increased impacts, including server control (e.g., shutdown/restart), domain manipulation (e.g., rogue computer objects), and network compromise via reconnaissance or client probing.
CWE: CWE-497
References: https://security.paloaltonetworks.com/CVE-2025-4235
CVE: CVE-2025-58434
Published: 2025-09-12
Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (`cloud.flowiseai.com`) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb[PII_REDACTED]33a596590d3d9c863 in version 3.0.6 secures password reset endpoints. Several recommended remediation steps are available. Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure `forgot-password` responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the `tempToken` (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/FlowiseAI/Flowise/commit/9e178d68873eb[PII_REDACTED]33a596590d3d9c863; https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wgpv-6j63-x5ph
CVE: CVE-2025-10323
Published: 2025-09-12
Description: A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is the function sub_409184 of the file /wizard_rep.shtml. The manipulation of the argument sel_EncrypTyp results in command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/adm.cgi/wizard_rep.shtml; https://vuldb.com/?ctiid.323749; https://vuldb.com/?id.323749
CVE: CVE-2025-10324
Published: 2025-09-12
Description: A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects the function sub_401C5C of the file firewall.cgi. This manipulation of the argument pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/firewall.cgi/websSysFirewall; https://vuldb.com/?ctiid.323750; https://vuldb.com/?id.323750
CVE: CVE-2025-10325
Published: 2025-09-12
Description: A vulnerability was identified in Wavlink WL-WN578W2 221110. This impacts the function sub_401340/sub_401BA4 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/ZZ2266/.github.io/blob/main/WAVLINK/WL-WN578W2/login.cgi/login/readme.md; https://vuldb.com/?ctiid.323751; https://vuldb.com/?id.323751
CVE: CVE-2025-43795
Published: 2025-09-12
Description: Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_SystemSettingsPortlet_redirect parameter.

Open redirect vulnerability in the Instance Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_InstanceSettingsPortlet_redirect parameter.

Open redirect vulnerability in the Site Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_site_admin_web_portlet_SiteSettingsPortlet_redirect parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43795
CVE: CVE-2025-43796
Published: 2025-09-12
Description: Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43796
CVE: CVE-2025-10326
Published: 2025-09-12
Description: A security flaw has been discovered in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/api/playlist/single.php. Performing manipulation of the argument playlist results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce3.md; https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce3.md#poc; https://vuldb.com/?ctiid.323752
CVE: CVE-2025-10327
Published: 2025-09-12
Description: A weakness has been identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/api/playlist/shuffle.php. Executing manipulation of the argument playlist can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce4.md; https://vuldb.com/?ctiid.323753; https://vuldb.com/?id.323753
CVE: CVE-2025-45583
Published: 2025-09-12
Description: Incorrect access control in the FTP protocol of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to authenticate into the service using any combination of username and password.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9
CVE: CVE-2025-45584
Published: 2025-09-12
Description: Incorrect access control in the web service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to download car information without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9
CVE: CVE-2025-45585
Published: 2025-09-12
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the wifi_sta_ssid or wifi_ap_ssid parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9
CVE: CVE-2025-45586
Published: 2025-09-12
Description: An issue in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to arbitrarily overwrite files via supplying a crafted PUT request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9
CVE: CVE-2025-45587
Published: 2025-09-12
Description: A stack overflow in the FTP service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.0 (HIGH)
CWE: CWE-121
References: https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9; https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9
CVE: CVE-2025-10176
Published: 2025-09-12
Description: The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the prepare_items function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/hackrepair-plugin-archiver/tags/2.0.4/includes/list.php#L39; https://www.wordfence.com/threat-intel/vulnerabilities/id/d449a285-34f5-41ed-acfd-2a9acfb04271?source=cve
CVE: CVE-2025-10328
Published: 2025-09-12
Description: A security vulnerability has been detected in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/api/playlist/playsinglefile.php. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce5.md; https://vuldb.com/?ctiid.323754; https://vuldb.com/?id.323754
CVE: CVE-2025-10329
Published: 2025-09-12
Description: A vulnerability was detected in cdevroe unmark up to 1.9.3. This affects an unknown part of the file /application/controllers/Marks.php. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/YZS17/CVE/blob/main/unmark/ssrf1.md; https://github.com/YZS17/CVE/blob/main/unmark/ssrf1.md#poc; https://vuldb.com/?ctiid.323755
CVE: CVE-2025-10330
Published: 2025-09-12
Description: A flaw has been found in cdevroe unmark up to 1.9.3. This vulnerability affects unknown code of the file application/views/layouts/topbar/searchform.php. This manipulation of the argument q causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/YZS17/CVE/blob/main/unmark/xss1.md; https://github.com/YZS17/CVE/blob/main/unmark/xss1.md#poc; https://vuldb.com/?ctiid.323756
CVE: CVE-2025-10331
Published: 2025-09-13
Description: A vulnerability has been found in cdevroe unmark up to 1.9.3. This issue affects some unknown processing of the file /application/controllers/Marks.php. Such manipulation of the argument Title leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/YZS17/CVE/blob/main/unmark/xss2.md; https://vuldb.com/?ctiid.323757; https://vuldb.com/?id.323757