rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-5753 All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmve_Schedules_Controller::save' handler for 'admin_post_ai1wm_schedule_event_save' not verifying user capabilities before saving schedule data. This makes it possible for authenticated attackers, with subscriber-level access and above, to create scheduled export jobs and send backup notifications to attacker-controlled email addresses. Because such notifications include the random backup filename, full site backups can subsequently be downloaded from the target site, resulting in sensitive information exposure.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: servmask
product: All-in-One WP Migration Unlimited Extension
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Sélim Lanouar
Published: 2026-05-06T03:27:21.807Z
CVE-2026-5754 Radware Alteon has a reflected XSS vulnerability
Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions, data theft, or other malicious activities.
Problem types: description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Radware
product: Alteon vADC
Published: 2026-04-14T17:51:12.616Z
CVE-2026-5755 Denial of service via crafted TIFF file upload
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.. Mattermost Advisory ID: MMSA-2026-00648
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
baseSeverity: MEDIUM
baseScore: 6.5
Credits: lang: en
value: ZephrFish
Published: 2026-05-22T10:18:49.798Z
CVE-2026-5756 Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS)
Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server's configuration file, potentially leading to mass data exfiltration, malicious traffic interception, or disruption of testing services.
Problem types: description: CWE-306 Missing Authentication for Critical Function
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Data Recognition Corporation
product: Central Office Services - Content Hosting Component
Published: 2026-04-14T17:51:53.628Z
CVE-2026-5758 Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution
JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.
Problem types: description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Mafintosh
product: Protocol-buffers-schema parser
Published: 2026-04-15T17:20:13.551Z
CVE-2026-5760 CVE-2026-5760
SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().
Problem types: description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: SGLang
product: SGLang
Published: 2026-04-20T13:46:23.603Z
CVE-2026-5762 ReportIncident DiscussionTools integration causes slow requests
Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS.
This issue was remediated only on the `master` branch.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of resources without limits or throttling
Affected products: vendor: Wikimedia Foundation
product: MediaWiki - ReportIncident Extension
default_status: unaffected
Credits: lang: en
value: Dreamy_Jazz
lang: en
value: STran
Published: 2026-04-07T18:42:35.336Z
CVE-2026-5766 Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation.
 
As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Kyle Agronick for reporting this issue.
Problem types: cwe_id: CWE-130
description: CWE-130: Improper Handling of Length Parameter Inconsistency
Affected products: vendor: djangoproject
product: Django
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Kyle Agronick
lang: en
value: Jacob Walls
lang: en
value: Sarah Boyce
Published: 2026-05-05T14:49:19.715Z
CVE-2026-5767 SlideShowPro SC <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute
The SlideShowPro SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `slideShowProSC` shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: luetkemj
product: SlideShowPro SC
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: nail majdeddine
Published: 2026-04-22T07:45:35.415Z
CVE-2026-5768 Fourth Frontier Frontier X Mobile Application, Frontier X2 Missing Authentication for Critical Function
The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities, triggering vibrations, causing denial-of-service conditions, and fuzzing characteristic values to induce unexpected behavior. Additionally, the Frontier X mobile application lacks proper BLE device authentication, allowing attackers to impersonate a legitimate Frontier X2 device and connect to the application. By cloning BLE advertisements and exposing expected GATT characteristics, attackers can manipulate activity states and inject fabricated health telemetry such as breathing rate, heart rate, strain, and other health-related data into the mobile application.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: Fourth Frontier
product: Frontier X Android application
default_status: unaffected
vendor: Fourth Frontier
product: Frontier X IOS application
default_status: unaffected
vendor: Fourth Frontier
product: Frontier X2
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Shakir Zari and Jerin Sunny reported this vulnerability to CISA.
Published: 2026-05-29T16:58:02.035Z
CVE-2026-5772 MatchDomainName 1-Byte Stack Buffer Over-Read in Hostname Validation
A 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c) during wildcard hostname validation when the LEFT_MOST_WILDCARD_ONLY flag is active.  If a wildcard * exhausts the entire hostname string, the function reads one byte past the buffer without a bounds check, which could cause a crash.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer over-read
Affected products: vendor: wolfSSL
product: wolfSSL
default_status: unaffected
Credits: lang: en
value: Zou Dikai
Published: 2026-04-09T21:50:04.038Z
CVE-2026-5773 wrong reuse of SMB connection
libcurl might in some circumstances reuse the wrong connection for SMB(S)
transfers.

libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a network transfer operation that was requested by an
application could wrongfully reuse an existing SMB connection to the same
server that was using a different 'share' than the new subsequent transfer
should.

This could in unlucky situations lead to the download of the wrong file or the
upload of a file to the wrong place. When this happens, the same credentials
are used and the server name is the same.
Problem types: description: CWE-488 Exposure of Data Element to Wrong Session
Affected products: vendor: curl
product: curl
default_status: unaffected
Credits: lang: en
value: Osama Hamad
lang: en
value: Daniel Stenberg
Published: 2026-05-13T08:27:42.342Z
CVE-2026-5774 Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map
Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Canonical
product: Juju
default_status: unaffected
Published: 2026-04-10T12:10:55.634Z
CVE-2026-5776 Email Encoder < 2.4.7 - Unauthenticated Stored XSS
The Email Encoder  WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Email Encoder
default_status: unaffected
Credits: lang: en
value: Matthew Rollings
lang: en
value: WPScan
Published: 2026-05-20T06:00:02.018Z
CVE-2026-5777 Security Misconfiguration Vulnerability in Atom 3x Projector
This vulnerability exists in the Atom 3x Projector due to improper exposure of the Android Debug Bridge (ADB) service over the local network without authentication or access controls. An unauthenticated attacker on the same network can exploit this vulnerability to obtain root-level access, leading to complete compromise of the targeted device.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing authentication for critical function
Affected products: vendor: EGate
product: Atom 3X Projector
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Chetan Nimbulkar
Published: 2026-04-10T11:40:55.335Z
CVE-2026-5778 Integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path.
Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in the AEAD decryption path by injecting a TLS record shorter than the explicit IV plus authentication tag into traffic inspected by ssl_DecodePacket. The underflow wraps a 16-bit length to a large value that is passed to AEAD decryption routines, causing a large out-of-bounds read and crash. An unauthenticated attacker can trigger this remotely via malformed TLS Application Data records.
Problem types: cwe_id: CWE-191
description: CWE-191 Integer underflow (wrap or wraparound)
Affected products: vendor: wolfSSL
product: wolfSSL
default_status: unaffected
Credits: lang: en
value: Zou Dikai
Published: 2026-04-09T21:45:09.053Z
CVE-2026-5779 Multiple vulnerabilities in MphRx's Minerva
An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/user/updateUserProfile' endpoint. This allows an authenticated user to modify the information of other registered users. Successful exploitation of this vulnerability allows an authenticated user to modify other users' information, such as their email address, and request a new password via the '/webconnect/#/forgotPassword' endpoint. This could lead to complete account takeover.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: MphRx
product: Minerva
default_status: unaffected
Credits: lang: en
value: Alejandro Rivera León
Published: 2026-04-28T11:41:35.416Z
CVE-2026-5780 Multiple vulnerabilities in MphRx's Minerva
An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the endpoint '/minerva/moUser/show/'. If this vulnerability is successfully exploited, an authenticated user can access the data of other registered users simply by modifying the ID. This allows an attacker to obtain a list of users.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: MphRx
product: Minerva
default_status: unaffected
Credits: lang: en
value: Alejandro Rivera León
Published: 2026-04-28T11:43:08.482Z
CVE-2026-5781 Multiple vulnerabilities in MphRx's Minerva
An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/update' endpoint, could allow an authenticated user with user modification privileges to escalate their privileges by sending an HTTP request with a manipulated 'identifier' field. Successful exploitation of this vulnerability could allow an authenticated user to obtain administrator privileges. It is not possible to escalate privileges through the graphical user interface.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: MphRx
product: Minerva
default_status: unaffected
Credits: lang: en
value: Alejandro Rivera León
Published: 2026-04-28T11:44:26.342Z
CVE-2026-5783 Reflected XSS in Beyaz Computer's CityPLus
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Software Design Industry and Trade Ltd. Co. CityPLus allows Reflected XSS.

This issue affects CityPLus: before V24.29750.1.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: Beyaz Computer Software Design Industry and Trade Ltd. Co.
product: CityPLus
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Credits: lang: en
value: Aleyna KABAL
Published: 2026-05-20T14:21:55.167Z
CVE-2026-5784 Stored XSS in DivvyDrive Information Technologies' DivvyDrive
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS.

This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: DivvyDrive Information Technologies Inc.
product: DivvyDrive
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Alperen KESKİN
Published: 2026-05-07T12:54:06.578Z
CVE-2026-5785 SQL Injection
Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
Affected products: vendor: Zohocorp
product: ManageEngine PAM360
default_status: unaffected
vendor: Zohocorp
product: ManageEngine Password Manager Pro
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published: 2026-04-16T13:46:28.313Z
CVE-2026-5786 
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Ivanti
product: Endpoint Manager Mobile
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2026-05-07T15:18:54.437Z
CVE-2026-5787 
An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper certificate validation
Affected products: vendor: Ivanti
product: Endpoint Manager Mobile
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseSeverity: HIGH
baseScore: 8.9
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Published: 2026-05-07T15:36:41.179Z
CVE-2026-5788 
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Ivanti
product: Endpoint Manager Mobile
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: LOW
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Published: 2026-05-07T15:29:49.630Z
CVE-2026-5789 Search path without quotes in CivetWeb
Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted search path or element
Affected products: vendor: CivetWeb
product: CivetWeb
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2026-04-21T14:22:05.872Z
CVE-2026-5790 Stored Cross-Site Scripting (XSS) vulnerability in Stel Order
Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in the database. When other users or administrators access the affected sections, the code executes in their browsers, enabling the theft of session cookies and account hijacking.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: Stel Order
product: Stel Order
default_status: unknown
Credits: lang: en
value: David Padilla Alvarado
Published: 2026-05-14T12:30:32.023Z
CVE-2026-5791 CSRF in DivvyDrive Information Technologies' DivvyDrive
Cross-Site request forgery (CSRF) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross Site Request Forgery.

This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site request forgery (CSRF)
Affected products: vendor: DivvyDrive Information Technologies Inc.
product: DivvyDrive
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Credits: lang: en
value: Halil KİRAZKAYA
Published: 2026-05-07T12:40:54.588Z
CVE-2026-5794 Vulnerability in Cryptobox allows an authenticated user to trigger an account lockout
A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request.
Problem types: cwe_id: CWE-694
description: CWE-694 Use of multiple resources with duplicate identifier
Affected products: vendor: Ercom
product: Cryptobox
default_status: affected
Published: 2026-04-28T17:09:55.609Z
CVE-2026-5795 
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.


Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.


A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Problem types: cwe_id: CWE-226
description: CWE-226 Sensitive information in resource not removed before reuse
cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Eclipse Foundation
product: Eclipse Jetty
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.4
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Credits: lang: en
value: https://github.com/HRsGIT
Published: 2026-04-08T13:32:28.935Z