deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5607
Published: 2025-06-04
Description: A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC18-formSetPPTPUserList-20653a41781f809fba95ff2c0a5c921b?source=copy_link; https://vuldb.com/?ctiid.311093; https://vuldb.com/?id.311093
CVE: CVE-2025-5608
Published: 2025-06-04
Description: A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formsetreboottimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC18-formsetreboottimer-20653a41781f801ab9e2e022dd089d69?source=copy_link; https://vuldb.com/?ctiid.311094; https://vuldb.com/?id.311094
CVE: CVE-2025-5609
Published: 2025-06-04
Description: A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC18-fromadvsetlanip-20653a41781f800fbc7bf9ca193c08e3?source=copy_link; https://vuldb.com/?ctiid.311095; https://vuldb.com/?id.311095
CVE: CVE-2025-46341
Published: 2025-06-04
Description: FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the `Remote-User` header or the `X-WebAuth-User` header by making specially crafted requests via the add feed functionality and obtaining the CSRF token via XPath scraping. The attacker has to know the IP address of the proxied FreshRSS instance and the admin's username, while also having an account on the instance. An attacker can send specially crafted requests in order to gain unauthorized access to internal services. This can also lead to privilege escalation like in the demonstrated scenario, although users that have setup OIDC are not affected by privilege escalation. Version 1.26.2 contains a patch for the issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-918
References: https://github.com/FreshRSS/FreshRSS/commit/6bb8680ae0051b9a2ff344f17814f4fa5d844628; https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w3m8-wcf4-h8vm
CVE: CVE-2025-48947
Published: 2025-06-04
Description: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for someone to be affected by the vulnerability: Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if the Cache-Control header is not properly set for sensitive responses. Users should upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch.
CWE: CWE-525
References: https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-f3fg-mf2q-fj3f
CVE: CVE-2025-5610
Published: 2025-06-04
Description: A vulnerability, which was classified as critical, has been found in CodeAstro Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file /submitpropertydelete.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli_submitpropertydelete.php.md; https://vuldb.com/?ctiid.311096
CVE: CVE-2025-5611
Published: 2025-06-04
Description: A vulnerability, which was classified as critical, was found in CodeAstro Real Estate Management System 1.0. This affects an unknown part of the file /submitpropertyupdate.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli_submitpropertyupdate.php.md; https://vuldb.com/?ctiid.311097
CVE: CVE-2025-5612
Published: 2025-06-04
Description: A vulnerability has been found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This vulnerability affects unknown code of the file /reporting.php. The manipulation of the argument fullname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_reporting_fullname.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.311098
CVE: CVE-2025-5613
Published: 2025-06-04
Description: A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This issue affects some unknown processing of the file /request-details.php. The manipulation of the argument requestid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_request-details.php_requestid.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.311099
CVE: CVE-2025-5614
Published: 2025-06-04
Description: A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been classified as critical. Affected is an unknown function of the file /search-report-result.php. The manipulation of the argument serachdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_search-report-result.php_searchdata.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.311100
CVE: CVE-2025-5615
Published: 2025-06-04
Description: A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /details.php. The manipulation of the argument requestid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_details.php_requestid.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.311101
CVE: CVE-2025-5690
Published: 2025-06-04
Description: PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pg_dump. This problem occurs only when dynamic masking is enabled, which is not the default setting. The problem is resolved in version 2.2.1
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/531
CVE: CVE-2025-49007
Published: 2025-06-04
Description: Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-1333
References: https://github.com/rack/rack/commit/4795831a0a310c2d31102749e551b38faab6401f; https://github.com/rack/rack/commit/aed514df37e33907df3c971ed3ca9a0a20ac2901; https://github.com/rack/rack/security/advisories/GHSA-47m2-26rw-j2jw
CVE: CVE-2025-5616
Published: 2025-06-04
Description: A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_admin_profile.php_mobilenumber.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.311102
CVE: CVE-2025-5617
Published: 2025-06-04
Description: A vulnerability classified as critical has been found in PHPGurukul Online Fire Reporting System 1.2. This affects an unknown part of the file /admin/manage-teams.php. The manipulation of the argument teamid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_admin_manage-teams.php_teamid.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.311103
CVE: CVE-2025-5618
Published: 2025-06-04
Description: A vulnerability classified as critical was found in PHPGurukul Online Fire Reporting System 1.2. This vulnerability affects unknown code of the file /admin/edit-team.php. The manipulation of the argument teamid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/YZS17/CVE/blob/main/Online_Fire_Reporting_System/sqli_admin_edit-team.php_teamid.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.311104
CVE: CVE-2025-5619
Published: 2025-06-04
Description: A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1. This issue affects the function formaddUserName of the file /goform/addUserName. The manipulation of the argument Password leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/xubeining/Cve_report/blob/main/A%20remote%20code%20execution%20vulnerability%20in%20the%20router%20CH22%20V1.0.0.1%20manufactured%20by%20Shenzhen%20Jixiangtengda%20Technology%20Co.%2C%20Ltd.md; https://vuldb.com/?ctiid.311105; https://vuldb.com/?id.311105
CVE: CVE-2025-5620
Published: 2025-06-05
Description: A vulnerability, which was classified as critical, was found in D-Link DIR-816 1.10CNB05. Affected is the function setipsec_config of the file /goform/setipsec_config. The manipulation of the argument localIP/remoteIP leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_48/48.md; https://vuldb.com/?ctiid.311106; https://vuldb.com/?id.311106
CVE: CVE-2025-5621
Published: 2025-06-05
Description: A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this vulnerability is the function qosClassifier of the file /goform/qosClassifier. The manipulation of the argument dip_address/sip_address leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_49/49.md; https://vuldb.com/?ctiid.311107; https://vuldb.com/?id.311107
CVE: CVE-2025-5622
Published: 2025-06-05
Description: A vulnerability was found in D-Link DIR-816 1.10CNB05 and classified as critical. Affected by this issue is the function wirelessApcli_5g of the file /goform/wirelessApcli_5g. The manipulation of the argument apcli_mode_5g/apcli_enc_5g/apcli_default_key_5g leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_50/50.md; https://vuldb.com/?ctiid.311108; https://vuldb.com/?id.311108
CVE: CVE-2025-5623
Published: 2025-06-05
Description: A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been classified as critical. This affects the function qosClassifier of the file /goform/qosClassifier. The manipulation of the argument dip_address/sip_address leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_51/51.md; https://vuldb.com/?ctiid.311109; https://vuldb.com/?id.311109
CVE: CVE-2025-49008
Published: 2025-06-05
Description: Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/codegit/traits/execute.php` allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a `Common::safe_execute` function that sanitizes all arguments using `escapeshellarg()` prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system.
CWE: CWE-78, CWE-88
References: https://github.com/Atheos/Atheos/commit/7e6c0eb45fa6d04d786a[PII_REDACTED]f2638fe792; https://github.com/Atheos/Atheos/security/advisories/GHSA-rwc2-4q8c-xj48; https://github.com/Atheos/Atheos/security/advisories/GHSA-rwc2-4q8c-xj48
CVE: CVE-2025-5624
Published: 2025-06-05
Description: A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been declared as critical. This vulnerability affects the function QoSPortSetup of the file /goform/QoSPortSetup. The manipulation of the argument port0_group/port0_remarker/ssid0_group/ssid0_remarker leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_53/53.md; https://vuldb.com/?ctiid.311110; https://vuldb.com/?id.311110
CVE: CVE-2025-5625
Published: 2025-06-05
Description: A vulnerability was found in Campcodes Online Teacher Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /search-teacher.php. The manipulation of the argument searchteacher leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/nikeWRL/CVE-/issues/1; https://vuldb.com/?ctiid.311111; https://vuldb.com/?id.311111
CVE: CVE-2025-5626
Published: 2025-06-05
Description: A vulnerability classified as critical has been found in Campcodes Online Teacher Record Management System 1.0. Affected is an unknown function of the file /admin/edit-subjects-detail.php. The manipulation of the argument editid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/nikeWRL/CVE-/issues/2; https://vuldb.com/?ctiid.311112; https://vuldb.com/?id.311112
CVE: CVE-2025-5627
Published: 2025-06-05
Description: A vulnerability classified as critical was found in code-projects Patient Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /sputum_form.php. The manipulation of the argument itr_no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/bazhahei123/CVE/blob/main/sql_cve_6_3.pdf; https://vuldb.com/?ctiid.311113
CVE: CVE-2025-5628
Published: 2025-06-05
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Food Menu Manager 1.0. Affected by this issue is some unknown functionality of the file /index.php of the component Add Menu Handler. The manipulation of the argument name/description leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/mysq13/CVE/issues/1; https://vuldb.com/?ctiid.311114; https://vuldb.com/?id.311114
CVE: CVE-2025-48432
Published: 2025-06-05
Description: An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-117
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/g/django-announce; https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
CVE: CVE-2025-49466
Published: 2025-06-05
Description: aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment part,
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-23
References: https://git.sr.ht/~rjarry/aerc/commit/2bbe75fe0bc87ab4c1e16c5a18c[PII_REDACTED]629; https://git.sr.ht/~rjarry/aerc/commit/93bec0de8ed5ab3d6b1f01026fe2ef20fa154329; https://git.sr.ht/~rjarry/aerc/commit/93bec0de8ed5ab3d6b1f01026fe2ef20fa154329
CVE: CVE-2025-5629
Published: 2025-06-05
Description: A vulnerability, which was classified as critical, was found in Tenda AC10 up to 15.03.06.47. This affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg of the component HTTP Handler. The manipulation of the argument startIp/endIp leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/pfwqdxwdd/cve/blob/main/4.md; https://vuldb.com/?ctiid.311115; https://vuldb.com/?id.311115
CVE: CVE-2025-5630
Published: 2025-06-05
Description: A vulnerability has been found in D-Link DIR-816 1.10CNB05 and classified as critical. This vulnerability affects unknown code of the file /goform/form2lansetup.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_54/54.md; https://vuldb.com/?ctiid.311116; https://vuldb.com/?id.311116
CVE: CVE-2025-5631
Published: 2025-06-05
Description: A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been classified as critical. Affected is an unknown function of the file /publicposts.php. The manipulation of the argument post leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/YZS17/CVE/blob/main/NEWS-BUZZ/sqli_publicposts.php_post.md; https://vuldb.com/?ctiid.311118; https://vuldb.com/?id.311118
CVE: CVE-2025-5632
Published: 2025-06-05
Description: A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/users.php. The manipulation of the argument change_to_admin leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/YZS17/CVE/blob/main/NEWS-BUZZ/sqli_users.php_change_to_admin.md; https://vuldb.com/?ctiid.311119; https://vuldb.com/?id.311119
CVE: CVE-2025-5633
Published: 2025-06-05
Description: A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/users.php. The manipulation of the argument delete leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/YZS17/CVE/blob/main/NEWS-BUZZ/sqli_users.php_delete.md; https://vuldb.com/?ctiid.311120; https://vuldb.com/?id.311120
CVE: CVE-2025-5634
Published: 2025-06-05
Description: A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component NOOP Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-c5e11f95f8d134e3c6b23c3b1b7ce5e79274ab0719f798f1bb509474b33b1c0e1.txt; https://vuldb.com/?ctiid.311121; https://vuldb.com/?id.311121
CVE: CVE-2025-5635
Published: 2025-06-05
Description: A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component PLS Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-67a2e172844905e3e09735d62ac7a925e8492f78c789c2995a1f2474c539ed8f95.txt; https://vuldb.com/?ctiid.311122; https://vuldb.com/?id.311122