rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-15540 Authenticated RCE in Raytha CMS
"Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restrictions, JavaScript code executed through Raytha’s “functions” feature can instantiate .NET components and perform arbitrary operations within the application’s hosting environment.

This issue was fixed in version 1.4.6.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Raytha
product: Raytha
default_status: unaffected
Credits: lang: en
value: Daniel Basta
Published: 2026-03-16T11:52:33.319Z
CVE-2025-15541 Access to System Files via SFTP on TP-Link VX800v
Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resulting in high confidentiality impact and limited integrity risk.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: TP-Link Systems Inc.
product: VX800v v1.0
default_status: unaffected
Published: 2026-01-29T18:05:57.407Z
CVE-2025-15542 Denial of Service (DoS) of VoIP Communication on TP-Link VX800v
Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all voice lines and causing a denial of service on incoming calls.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: TP-Link Systems Inc.
product: VX800v v1.0
default_status: unaffected
Published: 2026-01-29T18:06:21.474Z
CVE-2025-15543 Read-Only Root Access via USB Storage Device in TP-Link VX800v
Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physical access read‑only access to system files.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: TP-Link Systems Inc.
product: VX800v v1.0
default_status: unaffected
Published: 2026-01-29T18:06:44.747Z
CVE-2025-15545 Insufficient Backup File Upload Input Validation on TP-Link Archer RE605X
The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of arbitrary commands with root privileges. Successful exploitation allows the attacker to gain root-level command execution, compromising confidentiality, integrity and availability.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: TP-Link Systems Inc.
product: Archer RE605X
default_status: unaffected
Credits: lang: en
value: Nicola Giuffrida
Published: 2026-01-29T17:31:10.117Z
CVE-2025-15547 Jail escape by a privileged user via nullfs
By default, jailed processes cannot mount filesystems, including nullfs(4).  However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks.

If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic allows that user to escape the jail's chroot, yielding access to the full filesystem of the host or parent jail.

In a jail configured to allow nullfs(4) mounts from within the jail, the jailed root user can escape the jail's filesystem root.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Published: 2026-03-09T11:46:51.973Z
CVE-2025-15548 Missing Application-Layer Encryption in Web Interface Endpoints on TP-Link VX800v
Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network adjacent attacker to intercept this traffic and compromise its confidentiality.
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: TP-Link Systems Inc.
product: VX800v v1.0
default_status: unaffected
Published: 2026-01-29T18:07:08.997Z
CVE-2025-15549 FluentCMS 2026 Stored XSS via SVG Upload in File Management
FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload SVG files with embedded JavaScript via the File Management module. Attackers can upload malicious SVG files that execute JavaScript in the browser of any user accessing the uploaded file URL.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: FluentCMS
product: FluentCMS
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Jarosław Wawiórko
lang: en
value: Beatriz Fresno Naumova
Published: 2026-01-29T19:41:36.216Z
CVE-2025-15550 birkir prime <= 0.4.0.beta.0 - Cross-Site Request Forgery in GraphQL
birkir prime <= 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows attackers to exploit GET-based query requests. Attackers can craft malicious GET requests to trigger unauthorized actions against privileged users by manipulating GraphQL query parameters.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: birkir
product: prime
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: NinjaGPT
lang: en
value: Beatriz Fresno Naumova
Published: 2026-01-29T19:41:52.866Z
CVE-2025-15551 LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N
The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router's admin web portal without the user's permission or knowledge.
Problem types: cwe_id: CWE-95
description: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected products: vendor: TP-Link Systems Inc.
product: Archer MR200 v5.2
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer C20 v6
default_status: unaffected
vendor: TP Link Systems Inc.
product: TL-WR850N v3
default_status: unaffected
vendor: TP Link Systems Inc.
product: TL-WR845N v4
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Archer C20 v5
default_status: unaffected
Credits: lang: en
value: Swaroop Dora, Deven Lunkad, Ashutosh Kumar, and S. Venkatesan from IoT Security Research Lab, Indian Institute of Information Technology, Allahabad
Published: 2026-02-05T17:22:55.600Z
CVE-2025-15552 Long Session Lifetime in Truesec LAPSWebUI
Insufficient Session Expiration in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient session expiration
Affected products: vendor: Truesec
product: LAPSWebUI
default_status: unaffected
Credits: lang: en
value: Laban Sköllermark at Reversec Sweden AB
Published: 2026-03-16T10:44:02.659Z
CVE-2025-15553 Insecure Logout Functionality in Truesec LAPSWebUI
Non-working logout functionality in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient session expiration
Affected products: vendor: Truesec
product: LAPSWebUI
default_status: unaffected
Credits: lang: en
value: Laban Sköllermark at Reversec Sweden AB
Published: 2026-03-16T10:45:04.206Z
CVE-2025-15554 Admin Passwords Cached by Browsers in Truesec LAPSWebUI
Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin passwords.
Problem types: cwe_id: CWE-525
description: CWE-525 Use of web browser cache containing sensitive information
Affected products: vendor: Truesec
product: LAPSWebUI
default_status: unaffected
Credits: lang: en
value: Laban Sköllermark at Reversec Sweden AB
Published: 2026-03-16T10:46:09.397Z
CVE-2025-15555 Open5GS VoLTE Cx-Test hss-cx-path.c hss_ogs_diam_cx_mar_cb stack-based overflow
A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_cx_mar_cb of the file src/hss/hss-cx-path.c of the component VoLTE Cx-Test. The manipulation of the argument OGS_KEY_LEN results in stack-based buffer overflow. The attack may be launched remotely. The patch is identified as 54dda041211098730221d0ae20a2f9f9173e7a21. A patch should be applied to remediate this issue.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: n/a
product: Open5GS
cpes: cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
baseSeverity: HIGH
Credits: lang: en
value: Luca Jungnickel (Fraunhofer FOKUS)
lang: en
value: jungnickel (VulDB User)
lang: en
value: jungnickel (VulDB User)
Published: 2026-02-04T20:32:07.223Z
CVE-2025-15556 Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: notepad-plus-plus
product: notepad-plus-plus
default_status: unaffected
Published: 2026-02-03T00:50:29.516Z
CVE-2025-15557 Improper Certificate Validation in TP-Link Tapo H100 and P100 Allows Man-in-the-Middle Attack
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications.  This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: TP-Link Systems Inc.
product: Tapo H100 v1
default_status: unaffected
vendor: TP-Link Systems Inc.
product: Tapo P100 v1
default_status: unaffected
Credits: lang: en
value: Jere Ainasoja and Jack Sundholm from Test of Things
Published: 2026-02-05T17:45:28.407Z
CVE-2025-15558 Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.

This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the  github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager  package, such as Docker Compose.

This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Docker
product: Docker CLI
default_status: affected
vendor: Docker
product: Compose
default_status: unaffected
Credits: lang: en
value: Nitesh Surana (niteshsurana.com) of Trend Research of TrendAI
Published: 2026-03-04T16:14:32.045Z
CVE-2025-15559 Unauthenticated OS Command Injection in NesterSoft WorkTime
An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: NesterSoft Inc.
product: WorkTime (on-prem/cloud)
default_status: unknown
Credits: lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
Published: 2026-02-19T10:45:34.943Z
CVE-2025-15560 SQL Injection in NesterSoft WorkTime
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: NesterSoft Inc.
product: WorkTime (on-prem/cloud)
default_status: unknown
Credits: lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
Published: 2026-02-19T10:48:43.486Z
CVE-2025-15561 Local Privilege Escalation in NesterSoft WorkTime
An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named  WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which is writable by "Everyone". The executable will then be run by the WorkTime monitoring daemon.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: NesterSoft Inc.
product: WorkTime (on-prem/cloud)
default_status: unknown
Credits: lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
Published: 2026-02-19T10:53:18.501Z
CVE-2025-15562 Reflected Cross-Site Scripting in NesterSoft WorkTime
The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: NesterSoft Inc.
product: WorkTime (on-prem/cloud)
default_status: unknown
Credits: lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
Published: 2026-02-19T10:54:52.516Z
CVE-2025-15563 Broken Access Control results in Denial of Service in NesterSoft WorkTime
Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: NesterSoft Inc.
product: WorkTime (on-prem/cloud)
default_status: unknown
Credits: lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
Published: 2026-02-19T11:01:56.524Z
CVE-2025-15564 Mapnik value.cpp operator divide by zero
A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-369
description: Divide By Zero
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: Mapnik
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Oneafter (VulDB User)
Published: 2026-02-07T21:32:07.437Z
CVE-2025-15565 Nexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification
The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions up to, and including, 8.3.0. This makes it possible for unauthenticated attackers to mark pending WooCommerce orders as paid/completed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: cartasi
product: Nexi XPay
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Md. Moniruzzaman Prodhan
Published: 2026-04-14T21:26:40.111Z
CVE-2025-15566 ingress-nginx auth-proxy-set-headers nginx configuration injection
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Kubernetes
product: ingress-nginx
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Jan-Otto Kröpke
Published: 2026-02-06T03:13:51.717Z
CVE-2025-15567 
Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: vivo
product: Health
default_status: unaffected
Published: 2026-02-27T06:54:29.817Z
CVE-2025-15568 Command Injection Vulnerability on TP-Link Archer AXE75
A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router.  An authenticated attacker with adjacent-network access may be able to perform remote code execution (RCE) when the router is configured with sysmode=ap.  Successful exploitation results in root-level privileges and impacts confidentiality, integrity and availability of the device.

This issue affects Archer AXE75 v1.6/v1.0: through 1.3.2 Build 20250107.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: TP-Link Systems Inc.
product: Archer AXE75 v1.6/v1.0
default_status: unaffected
Credits: lang: en
value: Carlos Andrés Bello
Published: 2026-03-09T16:19:05.777Z
CVE-2025-15569 Artifex MuPDF win_main.c get_system_dpi uncontrolled search path
A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The exploitability is regarded as difficult. Upgrading to version 1.26.2 is sufficient to resolve this issue. Patch name: ebb125334eb007d64e579204af3c264aadf2e244. Upgrading the affected component is recommended.
Problem types: cwe_id: CWE-427
description: Uncontrolled Search Path
cwe_id: CWE-426
description: Untrusted Search Path
Affected products: vendor: Artifex
product: MuPDF
cpes: cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C
baseSeverity: HIGH
Credits: lang: en
value: nmaochea (VulDB User)
Published: 2026-02-10T10:02:09.074Z
CVE-2025-15570 ckolivas lrzip stream.c lzma_decompress_buf use after free
A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-416
description: Use After Free
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: ckolivas
product: lrzip
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: ziiiro (VulDB User)
Published: 2026-02-10T13:02:06.564Z
CVE-2025-15571 ckolivas lrzip stream.c ucompthread null pointer dereference
A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: ckolivas
product: lrzip
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: ziiiro (VulDB User)
Published: 2026-02-10T14:32:08.345Z