rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-4426 Libarchive: libarchive: denial of service via malformed iso file processing
A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.
Problem types: cwe_id: CWE-1335
description: Incorrect Bitwise Shift of Integer
Affected products: vendor: Red Hat
product: Red Hat Hardened Images
cpes: cpe:/a:redhat:hummingbird:1
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Elhanan Haenel for reporting this issue.
Published: 2026-03-19T13:53:39.318Z
CVE-2026-4428 CRL Distribution Point Scope Check Logic Error in AWS-LC
A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows  a revoked certificate to bypass certificate revocation checks.

To remediate this issue, users should upgrade to AWS-LC 1.71.0 or AWS-LC-FIPS-3.3.0.
Problem types: cwe_id: CWE-299
description: CWE-299 Improper check for certificate revocation
Affected products: vendor: AWS
product: AWS-LC
default_status: unaffected
vendor: AWS
product: AWS-LC-FIPS
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.4
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: 2026-03-19T20:37:53.851Z
CVE-2026-4429 OSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute
The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_name' and 'file_color_list' shortcode attribute of the [osm_map_v3] shortcode in all versions up to and including 6.1.15. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: photoweblog
product: OSM – OpenStreetMap
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Nguyen Ngoc Duc
Published: 2026-04-09T02:25:05.932Z
CVE-2026-4430 Heap Buffer Overflow in AgileEngine
Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters.

This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds write
Affected products: vendor: The Document Foundation
product: LibreOffice
default_status: unaffected
Credits: lang: en
value: Duc Anh Nguyen (@Danzation)
lang: en
value: Caolán McNamara <caolan.mcnamara@collabora.com>
Published: 2026-05-07T07:16:18.851Z
CVE-2026-4432 YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR
The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.
Problem types: description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: YITH WooCommerce Wishlist
default_status: unaffected
Credits: lang: en
value: Chiao-Lin Yu (Steven Meow)
lang: en
value: WPScan
Published: 2026-04-10T06:00:15.515Z
CVE-2026-4433 
An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPorts. This could be used to potentially glean information about the underlying system and give an attacker information that could be used to attempt to compromise the host.
Problem types: cwe_id: CWE-16
description: CWE-16: Configuration
Affected products: vendor: Tenable, Inc.
product: Tenable Operation Technology
default_status: unaffected
Published: 2026-03-24T20:26:15.338Z
CVE-2026-4434 
Improper certificate validation in the PAM propagation WinRM connections
 allows a network attacker to perform a man-in-the-middle attack via 
disabled TLS certificate verification.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper certificate validation
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-03-20T12:52:55.762Z
CVE-2026-4436 GPL Odorizers GPL750 Missing Authentication for Critical Function
A low-privileged remote attacker can send Modbus packets to manipulate 
register values that are inputs to the odorant injection logic such that
 too much or too little odorant is injected into a gas line.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: GPL Odorizers
product: GPL750 (XL4)
default_status: unaffected
vendor: GPL Odorizers
product: GPL750 (XL4 Prime)
default_status: unaffected
vendor: GPL Odorizers
product: GPL Odorizers GPL750 (XL7)
default_status: unaffected
vendor: GPL Odorizers
product: GPL Odorizers GPL750 (XL7 Prime)
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Credits: lang: en
value: An anonymous researcher reported this vulnerability to CISA.
Published: 2026-04-09T20:04:26.208Z
CVE-2026-4437 gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds read
Affected products: vendor: The GNU C Library
product: glibc
default_status: unaffected
Credits: lang: en
value: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me
lang: en
value: Kevin Farrell
Published: 2026-03-20T19:59:00.427Z
CVE-2026-4438 gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper input validation
Affected products: vendor: The GNU C Library
product: glibc
default_status: unaffected
Credits: lang: en
value: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me
Published: 2026-03-20T19:59:06.064Z
CVE-2026-4439 
Out of bounds memory access in WebGL in Google Chrome on Android prior to 146.0.7680.153 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Problem types: description: Out of bounds memory access
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:43.403Z
CVE-2026-4440 
Out of bounds read and write in WebGL in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Critical)
Problem types: description: Out of bounds read and write
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:44.077Z
CVE-2026-4441 
Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:44.671Z
CVE-2026-4442 
Heap buffer overflow in CSS in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:45.297Z
CVE-2026-4443 
Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:45.861Z
CVE-2026-4444 
Stack buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-121
description: Stack buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:46.432Z
CVE-2026-4445 
Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:47.124Z
CVE-2026-4446 
Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:47.750Z
CVE-2026-4447 
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:48.387Z
CVE-2026-4448 
Heap buffer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:48.933Z
CVE-2026-4449 
Use after free in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:49.580Z
CVE-2026-4450 
Out of bounds write in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-787
description: Out of bounds write
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:50.389Z
CVE-2026-4451 
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-20
description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:50.952Z
CVE-2026-4452 
Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-472
description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:51.585Z
CVE-2026-4453 
Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-472
description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:52.142Z
CVE-2026-4454 
Use after free in Network in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:53.048Z
CVE-2026-4455 
Heap buffer overflow in PDFium in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:53.624Z
CVE-2026-4456 
Use after free in Digital Credentials API in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:54.164Z
CVE-2026-4457 
Type Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-843
description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:54.761Z
CVE-2026-4458 
Use after free in Extensions in Google Chrome prior to 146.0.7680.153 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:55.397Z
CVE-2026-4459 
Out of bounds read and write in WebAudio in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Out of bounds read and write
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:56.021Z
CVE-2026-4460 
Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-125
description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:56.641Z
CVE-2026-4461 
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:57.198Z
CVE-2026-4462 
Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-125
description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:57.730Z
CVE-2026-4463 
Heap buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:58.342Z
CVE-2026-4464 
Integer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-472
description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-03-20T01:34:58.888Z
CVE-2026-4465 D-Link DIR-513 formSysCmd os command injection
A flaw has been found in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formSysCmd. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: D-Link
product: DIR-513
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: AttackingLin (VulDB User)
Published: 2026-03-20T02:02:14.751Z
CVE-2026-4466 Comfast CF-AC100 mbox-config command injection
A vulnerability has been found in Comfast CF-AC100 2.6.0.8. This affects an unknown function of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Comfast
product: CF-AC100
cpes: cpe:2.3:o:comfast:cf-ac100_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: allanp0e (VulDB User)
lang: en
value: VulDB
Published: 2026-03-20T02:02:17.642Z
CVE-2026-4467 Comfast CF-AC100 mbox-config command injection
A vulnerability was found in Comfast CF-AC100 2.6.0.8. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET&section=wireless_device_dissoc. The manipulation results in command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Comfast
product: CF-AC100
cpes: cpe:2.3:o:comfast:cf-ac100_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: allanp0e (VulDB User)
lang: en
value: VulDB
Published: 2026-03-20T02:32:10.454Z
CVE-2026-4468 Comfast CF-AC100 mbox-config command injection
A vulnerability was determined in Comfast CF-AC100 2.6.0.8. Affected is an unknown function of the file /cgi-bin/mbox-config?method=SET&section=update_interface_png. This manipulation causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Comfast
product: CF-AC100
cpes: cpe:2.3:o:comfast:cf-ac100_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: allanp0e (VulDB User)
lang: en
value: VulDB
Published: 2026-03-20T03:32:10.679Z
CVE-2026-4469 itsourcecode Online Frozen Foods Ordering System admin_edit_menu_action.php sql injection
A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_edit_menu_action.php. Such manipulation of the argument product_name leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Online Frozen Foods Ordering System
cpes: cpe:2.3:a:itsourcecode:online_frozen_foods_ordering_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: OneChicken (VulDB User)
Published: 2026-03-20T04:02:12.099Z
CVE-2026-4470 itsourcecode Online Frozen Foods Ordering System admin_edit_menu.php sql injection
A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_edit_menu.php. Performing a manipulation of the argument product_name results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Online Frozen Foods Ordering System
cpes: cpe:2.3:a:itsourcecode:online_frozen_foods_ordering_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: OneChicken (VulDB User)
Published: 2026-03-20T04:32:11.078Z