rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-4812 Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: wpengine
product: Advanced Custom Fields (ACF®)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Fernando Mecozzi
Published: 2026-04-15T01:25:17.540Z
CVE-2026-4815 SQL Injection vulnerability in Support Board
A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls[0][message_ids][]' parameter in '/supportboard/include/ajax.php' endpoint.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
Affected products: vendor: Schiocco
product: Support Board
default_status: unaffected
Published: 2026-03-25T13:31:52.953Z
CVE-2026-4816 Reflected Cross Site Scripting (XSS) vulnerability in Support Board
A Reflected Cross Site Scripting (XSS) vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the 'search' parameter in '/supportboard/include/articles.php'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: Schiocco
product: Support Board
default_status: unaffected
Published: 2026-03-25T13:31:47.952Z
CVE-2026-4817 MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters
The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based Blind SQL Injection via the 'order' and 'orderby' parameters in the /lms/stm-lms/order/items REST API endpoint in versions up to and including 3.7.25. This is due to insufficient input sanitization combined with a design flaw in the custom Query builder class that allows unquoted SQL injection in ORDER BY clauses. When the Query builder detects parentheses in the sort_by parameter, it treats the value as a SQL function and directly concatenates it into the ORDER BY clause without any quoting. While esc_sql() is applied to escape quotes and backslashes, this cannot prevent ORDER BY injection when the values themselves are not wrapped in quotes in the resulting SQL statement. This makes it possible for authenticated attackers, with subscriber-level access and above, to append arbitrary SQL queries via the ORDER BY clause to extract sensitive information from the database including user credentials, session tokens, and other confidential data through time-based blind SQL injection techniques.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: stylemix
product: MasterStudy LMS WordPress Plugin – for Online Courses and Education
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Naoya Takahashi
Published: 2026-04-17T01:24:37.193Z
CVE-2026-4818 Some management operations on data streams are not properly restricted when user does not have the necessary privileges
In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams.
Problem types: cwe_id: CWE-285
description: CWE-285
cwe_id: CWE-862
description: CWE-862
Affected products: vendor: floragunn
product: Search Guard FLX
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Published: 2026-03-31T14:53:19.875Z
CVE-2026-4819 Search Guard audit logs can contain under certain conditions user credentials
In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.
Problem types: cwe_id: CWE-532
description: CWE-532
cwe_id: CWE-522
description: CWE-522
Affected products: vendor: floragunn
product: Search Guard FLX
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Published: 2026-03-31T14:57:56.792Z
CVE-2026-4820 IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag
IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Problem types: cwe_id: CWE-614
description: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: IBM
product: Maximo Application Suite
cpes: cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Published: 2026-04-01T20:54:09.417Z
CVE-2026-4821 Proxy configuration command injection vulnerability found in GitHub Enterprise Server Management Console configuration API
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and administrator privileges to the Management Console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
Affected products: vendor: GitHub
product: Enterprise Server
default_status: affected
Credits: lang: en
value: Seokchan Yoon
Published: 2026-04-21T22:12:26.772Z
CVE-2026-4822 Enter Software Iperius Backup Backup Service temp file
A vulnerability was detected in Enter Software Iperius Backup up to 8.7.3. Affected is an unknown function of the file C:\ProgramData\IperiusBackup\Jobs\ of the component Backup Service. Performing a manipulation results in creation of temporary file with insecure permissions. The attack is only possible with local access. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit is now public and may be used. Upgrading to version 8.7.4 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Problem types: cwe_id: CWE-378
description: Creation of Temporary File With Insecure Permissions
cwe_id: CWE-377
description: Insecure Temporary File
Affected products: vendor: Enter Software
product: Iperius Backup
CVSS v3.1: version: 3.1
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseSeverity: HIGH
Credits: lang: en
value: 0truust (VulDB User)
lang: en
value: VulDB
Published: 2026-03-25T20:31:47.588Z
CVE-2026-4823 Enter Software Iperius Backup NTLM2 information disclosure
A flaw has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this vulnerability is an unknown functionality of the component NTLM2 Handler. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. Attacks of this nature are highly complex. The exploitation appears to be difficult. The exploit has been published and may be used. Upgrading to version 8.7.4 addresses this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Problem types: cwe_id: CWE-200
description: Information Disclosure
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: Enter Software
product: Iperius Backup
CVSS v3.1: version: 3.1
baseScore: 2.5
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
baseSeverity: LOW
Credits: lang: en
value: 0truust (VulDB User)
lang: en
value: VulDB
Published: 2026-03-25T21:44:31.478Z
CVE-2026-4824 Enter Software Iperius Backup Backup Job Configuration File privileges management
A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job Configuration File Handler. The manipulation leads to improper privilege management. The attack must be carried out locally. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 8.7.4 can resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: Enter Software
product: Iperius Backup
CVSS v3.1: version: 3.1
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseSeverity: HIGH
Credits: lang: en
value: 0truust (VulDB User)
lang: en
value: VulDB
Published: 2026-03-25T21:44:35.374Z
CVE-2026-4825 SourceCodester Sales and Inventory System HTTP GET Parameter update_sales.php sql injection
A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file /update_sales.php of the component HTTP GET Parameter Handler. The manipulation of the argument sid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Sales and Inventory System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: FuKun (VulDB User)
Published: 2026-03-25T22:32:22.769Z
CVE-2026-4826 SourceCodester Sales and Inventory System HTTP GET Parameter update_stock.php sql injection
A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /update_stock.php of the component HTTP GET Parameter Handler. This manipulation of the argument sid causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Sales and Inventory System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: 563742137abc (VulDB User)
Published: 2026-03-25T23:35:27.687Z
CVE-2026-4827 Insufficient Entropy vulnerability on Multiple Products
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
Problem types: cwe_id: CWE-331
description: CWE-331 Insufficient entropy
Affected products: vendor: Schneider Electric
product: Easergy MiCOM C264
default_status: unaffected
vendor: Schneider Electric
product: Easergy C5
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P30
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P40
default_status: unaffected
vendor: Schneider Electric
product: EcoStruxure™ Power Automation System Gateway (EPAS-GTW)
default_status: unaffected
vendor: Schneider Electric
product: EcoStruxure™ Power Automation System User Interface (EPAS-UI)
default_status: unaffected
vendor: Schneider Electric
product: EcoStruxure™ Power Operation
default_status: unaffected
vendor: Schneider Electric
product: iPMFLS
default_status: unaffected
vendor: Schneider Electric
product: PowerLogic™ P5 Protection Relay
default_status: unaffected
vendor: Schneider Electric
product: PowerLogic™ P7 Protection and Control Platform
default_status: unaffected
vendor: Schneider Electric
product: PowerLogic™ T300
default_status: unaffected
vendor: Schneider Electric
product: PowerLogic™ T500
default_status: unaffected
vendor: Schneider Electric
product: Saitel DP
default_status: unaffected
vendor: Schneider Electric
product: EasyLogic T150 (formerly Saitel DR)
default_status: unaffected
Published: 2026-05-12T12:24:22.928Z
CVE-2026-4828 
Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor authentication via a crafted login request.
Problem types: cwe_id: CWE-1390
description: CWE-1390
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-04-01T14:48:53.684Z
CVE-2026-4829 
Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-04-01T14:44:05.292Z
CVE-2026-4830 kalcaddle kodbox Public Share userShare.class.php add privilege escalation
A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the file app/controller/explorer/userShare.class.php of the component Public Share Handler. Such manipulation leads to unrestricted upload. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: kalcaddle
product: kodbox
CVSS v3.1: version: 3.1
baseScore: 5.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: vulnplusbot (VulDB User)
lang: en
value: VulDB
Published: 2026-03-26T00:18:14.961Z
CVE-2026-4831 kalcaddle kodbox Password-protected Share auth.class.php can improper authentication
A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.class.php of the component Password-protected Share Handler. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: kalcaddle
product: kodbox
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: vulnplusbot (VulDB User)
lang: en
value: VulDB
Published: 2026-03-26T01:02:35.060Z
CVE-2026-4832 
CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attacker is able to interrogate the SNMP port.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-Coded Credentials
Affected products: vendor: Schneider Electric
product: Easergy MiCOM P14x
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P24x
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P341
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P342, P343, P344, P345
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P442, P444
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P443, P445, P446, P543, P544, P545, P546
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P642, P645
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P643
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P741, P742, P743
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P746
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P841
default_status: unaffected
vendor: Schneider Electric
product: Easergy MiCOM P849
default_status: unaffected
Published: 2026-04-14T15:05:00.845Z
CVE-2026-4833 Orc discount Markdown markdown.c compile recursion
A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I've been working on."
Problem types: cwe_id: CWE-674
description: Uncontrolled Recursion
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: Orc
product: discount
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
baseSeverity: LOW
Credits: lang: en
value: MTHG (VulDB User)
Published: 2026-03-26T01:02:39.046Z
CVE-2026-4834 WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter
The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: weDevs
product: WP ERP Pro
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: kudakwashe savanhu
Published: 2026-05-22T02:28:07.862Z
CVE-2026-4835 code-projects Accounting System Web Application add_costumer.php cross site scripting
A security vulnerability has been detected in code-projects Accounting System 1.0. Impacted is an unknown function of the file /my_account/add_costumer.php of the component Web Application Interface. Such manipulation of the argument costumer_name leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: code-projects
product: Accounting System
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: AhmadMarzook (VulDB User)
Published: 2026-03-26T01:52:17.744Z
CVE-2026-4836 code-projects Accounting System delete.php sql injection
A vulnerability was detected in code-projects Accounting System 1.0. The affected element is an unknown function of the file /my_account/delete.php. Performing a manipulation of the argument cos_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Accounting System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: AhmadMarzook (VulDB User)
Published: 2026-03-26T01:52:20.625Z
CVE-2026-4837 Eval Injection in Rapid7 Insight Agent
An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.
Problem types: cwe_id: CWE-95
description: CWE-95 Improper neutralization of directives in dynamically evaluated code ('eval injection')
Affected products: vendor: Rapid7
product: Insight Agent
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: John Rodriguez
lang: en
value: Cyberdagger
Published: 2026-04-08T15:59:03.121Z