deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-49443
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris McCoy Bacon Ipsum bacon-ipsum allows Stored XSS.This issue affects Bacon Ipsum: from n/a through <= 2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bacon-ipsum/vulnerability/wordpress-bacon-ipsum-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49445
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive UK Regional Map interactive-uk-regional-map allows Cross Site Request Forgery.This issue affects Interactive UK Regional Map: from n/a through <= 2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/interactive-uk-regional-map/vulnerability/wordpress-interactive-uk-regional-map-plugin-2-0-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-49446
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a through <= 1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/admin-note/vulnerability/wordpress-admin-notes-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49449
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive Regional Map of Africa interactive-map-of-africa allows Cross Site Request Forgery.This issue affects Interactive Regional Map of Africa: from n/a through <= 1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/interactive-map-of-africa/vulnerability/wordpress-interactive-regional-map-of-africa-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49450
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mhallmann SEPA Girocode sepa-girocode allows Stored XSS.This issue affects SEPA Girocode: from n/a through <= 0.5.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sepa-girocode/vulnerability/wordpress-sepa-girocode-0-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49453
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jatinder Pal Singh BP Profile as Homepage bp-profile-as-homepage allows Stored XSS.This issue affects BP Profile as Homepage: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/bp-profile-as-homepage/vulnerability/wordpress-bp-profile-as-homepage-plugin-1-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-5764
Published: 2025-06-06
Description: A vulnerability was found in code-projects Laundry System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/insert_laundry.php. The manipulation of the argument Customer leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/tuooo/CVE/issues/5; https://vuldb.com/?ctiid.311306
CVE: CVE-2025-5765
Published: 2025-06-06
Description: A vulnerability was found in code-projects Laundry System 1.0. It has been classified as problematic. This affects an unknown part of the file /data/edit_laundry.php. The manipulation of the argument Customer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/tuooo/CVE/issues/6; https://vuldb.com/?ctiid.311307
CVE: CVE-2025-5766
Published: 2025-06-06
Description: A vulnerability was found in code-projects Laundry System 1.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://code-projects.org/; https://github.com/tuooo/CVE/issues/7; https://vuldb.com/?ctiid.311308
CVE: CVE-2025-0620
Published: 2025-06-06
Description: A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-552
References: https://access.redhat.com/security/cve/CVE-2025-0620; https://bugzilla.redhat.com/show_bug.cgi?id=2370453; https://www.samba.org/samba/security/CVE-2025-0620.html
CVE: CVE-2025-38001
Published: 2025-06-06
Description: In the Linux kernel, the following vulnerability has been resolved:

net_sched: hfsc: Address reentrant enqueue adding class to eltree twice

Savino says:
    "We are writing to report that this recent patch
    (141d34391abbb315d68556b7c67ad[PII_REDACTED]7) [1]
    can be bypassed, and a UAF can still occur when HFSC is utilized with
    NETEM.

    The patch only checks the cl->cl_nactive field to determine whether
    it is the first insertion or not [2], but this field is only
    incremented by init_vf [3].

    By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the
    check and insert the class twice in the eltree.
    Under normal conditions, this would lead to an infinite loop in
    hfsc_dequeue for the reasons we already explained in this report [5].

    However, if TBF is added as root qdisc and it is configured with a
    very low rate,
    it can be utilized to prevent packets from being dequeued.
    This behavior can be exploited to perform subsequent insertions in the
    HFSC eltree and cause a UAF."

To fix both the UAF and the infinite loop, with netem as an hfsc child,
check explicitly in hfsc_enqueue whether the class is already in the eltree
whenever the HFSC_RSC flag is set.

[1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad[PII_REDACTED]7
[2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572
[3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677
[4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574
[5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://git.kernel.org/stable/c/295f7c579b07b5b7cf2dffe485f71cc2f27647cb; https://git.kernel.org/stable/c/2c928b3a0b04a431ffcd6c8b7d88a267124a3a28; https://git.kernel.org/stable/c/2f2190ce4ca972051cac6a8d7937448f8cb9673c
CVE: CVE-2025-38002
Published: 2025-06-06
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()

Not everything requires locking in there, which is why the 'has_lock'
variable exists. But enough does that it's a bit unwieldy to manage.
Wrap the whole thing in a ->uring_lock trylock, and just return
with no output if we fail to grab it. The existing trylock() will
already have greatly diminished utility/output for the failure case.

This fixes an issue with reading the SQE fields, if the ring is being
actively resized at the same time.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/bdb7d2ec2e31c46c45d1f32667dfa8216a72705e; https://git.kernel.org/stable/c/d871198ee431d90f5308d53998c1ba1d5db5619a; https://project-zero.issues.chromium.org/issues/417522668
CVE: CVE-2025-5778
Published: 2025-06-06
Description: A vulnerability, which was classified as critical, was found in 1000 Projects ABC Courier Management System 1.0. Affected is an unknown function of the file /admin. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/ubfbuz3/cve/issues/18; https://vuldb.com/?ctiid.311322
CVE: CVE-2025-5791
Published: 2025-06-06
Description: A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
CVSS Score: 7.1 (HIGH)
CWE: CWE-266
References: https://access.redhat.com/errata/RHSA-2025:12359; https://access.redhat.com/security/cve/CVE-2025-5791; https://bugzilla.redhat.com/show_bug.cgi?id=2370001
CVE: CVE-2025-5806
Published: 2025-06-06
Description: Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to change report content.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2025-06-06/#SECURITY-3588; http://www.openwall.com/lists/oss-security/2025/06/06/8
CVE: CVE-2025-27531
Published: 2025-06-06
Description: Deserialization of Untrusted Data vulnerability in Apache InLong. 

This issue affects Apache InLong: from 1.13.0 before 2.1.0, 

this issue would allow an authenticated attacker to read arbitrary files by double writing the param.





Users are recommended to upgrade to version 2.1.0, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5; http://www.openwall.com/lists/oss-security/2025/02/28/2
CVE: CVE-2025-41646
Published: 2025-06-06
Description: An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-704
References: https://psirt.kunbus.com/.well-known/csaf/white/2025/kunbus-2[PII_REDACTED].json; https://www.kunbus.com/en/productsecurity/Kunbus-2[PII_REDACTED]
CVE: CVE-2025-5779
Published: 2025-06-06
Description: A vulnerability has been found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /birthing.php. The manipulation of the argument itr_no/comp_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Thiasap/HCPMS_PHP_vulns/blob/main/sql%20injection%20in%20birthing.php.pdf; https://vuldb.com/?ctiid.311323
CVE: CVE-2025-5780
Published: 2025-06-06
Description: A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view_dental.php. The manipulation of the argument itr_no leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Thiasap/HCPMS_PHP_vulns/blob/main/sql%20injection%20in%20view_dental.php.pdf; https://vuldb.com/?ctiid.311324
CVE: CVE-2025-5782
Published: 2025-06-06
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Employee Record Management System 1.3. Affected by this issue is some unknown functionality of the file /resetpassword.php. The manipulation of the argument newpassword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/57; https://phpgurukul.com/; https://vuldb.com/?ctiid.311330
CVE: CVE-2024-13087
Published: 2025-06-06
Description: A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
QuRouter 2.4.6.028 and later
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-25-15
CVE: CVE-2024-13088
Published: 2025-06-06
Description: An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
QuRouter 2.5.0.140 and later
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://www.qnap.com/en/security-advisory/qsa-25-15
CVE: CVE-2024-50406
Published: 2025-06-06
Description: A cross-site scripting (XSS) vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following version:
License Center 1.9.49 and later
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-25-11
CVE: CVE-2024-56805
Published: 2025-06-06
Description: A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to modify memory or crash processes.

We have already fixed the vulnerability in the following versions:
QTS 5.2.4.3079 build 20250321 and later
QuTS hero h5.2.4.3079 build 20250321 and later
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-120, CWE-122
References: https://www.qnap.com/en/security-advisory/qsa-25-12
CVE: CVE-2025-22481
Published: 2025-06-06
Description: A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to execute arbitrary commands.

We have already fixed the vulnerability in the following versions:
QTS 5.2.4.3079 build 20250321 and later
QuTS hero h5.2.4.3079 build 20250321 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-25-12
CVE: CVE-2025-22482
Published: 2025-06-06
Description: A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data or modify memory.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.6 ( 2025/03/20 ) and later
CVSS Score: 8.1 (HIGH)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-25-10
CVE: CVE-2025-22484
Published: 2025-06-06
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote  attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-16
CVE: CVE-2025-22486
Published: 2025-06-06
Description: An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system.

We have already fixed the vulnerability in the following versions:
File Station 5 5.5.6.4791 and later
  and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://www.qnap.com/en/security-advisory/qsa-25-09
CVE: CVE-2025-22490
Published: 2025-06-06
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote  attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-16
CVE: CVE-2025-29871
Published: 2025-06-06
Description: An out-of-bounds read vulnerability has been reported to affect File Station 5. If a local  attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.qnap.com/en/security-advisory/qsa-25-16
CVE: CVE-2025-29872
Published: 2025-06-06
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote  attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-16
CVE: CVE-2025-29873
Published: 2025-06-06
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote  attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-16
CVE: CVE-2025-29876
Published: 2025-06-06
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote  attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-16
CVE: CVE-2025-29877
Published: 2025-06-06
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote  attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-16
CVE: CVE-2025-29883
Published: 2025-06-06
Description: An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system.

We have already fixed the vulnerability in the following versions:
File Station 5 5.5.6.4791 and later
  and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://www.qnap.com/en/security-advisory/qsa-25-09
CVE: CVE-2025-29884
Published: 2025-06-06
Description: An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system.

We have already fixed the vulnerability in the following versions:
File Station 5 5.5.6.4791 and later
  and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://www.qnap.com/en/security-advisory/qsa-25-09
CVE: CVE-2025-29885
Published: 2025-06-06
Description: An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system.

We have already fixed the vulnerability in the following versions:
File Station 5 5.5.6.4791 and later
  and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://www.qnap.com/en/security-advisory/qsa-25-09
CVE: CVE-2025-29892
Published: 2025-06-06
Description: An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.6 ( 2025/03/20 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-25-10
CVE: CVE-2025-30279
Published: 2025-06-06
Description: An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote  attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://www.qnap.com/en/security-advisory/qsa-25-16
CVE: CVE-2025-33031
Published: 2025-06-06
Description: An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://www.qnap.com/en/security-advisory/qsa-25-16
CVE: CVE-2025-33035
Published: 2025-06-06
Description: A path traversal vulnerability has been reported to affect File Station 5. If a remote  attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-16
CVE: CVE-2025-5747
Published: 2025-06-06
Description: WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installatons of WOLFBOX Level 2 EV Charger devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of command frames received by the MCU. When parsing frames, the process does not properly detect the start of a frame, which can lead to misinterpretation of input. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26501.
CVSS Score: 8.0 (HIGH)
CWE: CWE-115
References: https://www.zerodayinitiative.com/advisories/ZDI-25-326/
CVE: CVE-2025-5748
Published: 2025-06-06
Description: WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WOLFBOX Level 2 EV Charger. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the Tuya communications module software. The issue results from the exposure of a method allowing the upload of crafted software images to the module. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26349.
CVSS Score: 8.0 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-327/