rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-32841 Edimax GS-5008PL <= 1.00.54 Global Authentication State Across All Clients
Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the management interface. Attackers can exploit the global authentication flag mechanism to gain administrative access without credentials after any user authenticates, enabling unauthorized password changes, firmware uploads, and configuration modifications.
Problem types: cwe_id: CWE-1108
description: Excessive Reliance on Global Variables
Affected products: vendor: EDIMAX Technology Co., Ltd.
product: Edimax GS-5008PL
default_status: unknown
CVSS v3.1: attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
version: 3.1
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-03-17T21:41:28.349Z
CVE-2026-32842 Edimax GS-5008PL <= 1.00.54 Admin Credentials Stored in Cleartext
Edimax GS-5008PL firmware version 1.00.54 and prior contain an insecure credential storage vulnerability that allows attackers to obtain administrator credentials by accessing configuration backup files. Attackers can download the config.bin file through fupload.cgi to extract plaintext username and password fields for unauthorized administrative access.
Problem types: cwe_id: CWE-312
description: Cleartext Storage of Sensitive Information
Affected products: vendor: EDIMAX Technology Co., Ltd.
product: Edimax GS-5008PL
default_status: unknown
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-03-17T21:41:55.905Z
CVE-2026-32843 Linkit ONE Location Aware Sensor System (LASS) Reflected XSS via PM25.php
Location Aware Sensor System by Linkit ONE, up to commit f06bd20 (2023-04-26), contains a reflected cross-site scripting vulnerability in the PM25.php file that allows remote attackers to execute arbitrary JavaScript by injecting malicious code into GET parameters. Attackers can craft a malicious URL containing unencoded payloads in the site, city, district, channel, or apikey parameters to execute scripts in victims' browsers when they visit the page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: LinkItONEDevGroup
product: Location Aware Sensor System (LASS)
default_status: unknown
Credits: lang: en
value: philopentest
Published: 2026-03-19T14:39:21.909Z
CVE-2026-32844 XinLiangCoder / php_api_doc Reflected XSS via list_method.php
XinLiangCoder php_api_doc through commit 1ce5bbf contains a reflected cross-site scripting vulnerability in list_method.php that allows remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious code through the f parameter. Attackers can craft a malicious URL with unsanitized input in the GET request parameter that is output directly to the page without proper neutralization, enabling session hijacking, credential theft, or malware distribution within the application context.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: XinLiangCoder
product: php_api_doc
default_status: unknown
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: philopentest
Published: 2026-03-20T17:26:30.839Z
CVE-2026-32845 jkuhlmann / cgltf <= 1.15 Sparse Accessor Validation Integer Overflow
cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_index_bound(), resulting in denial of service crashes and potential memory disclosure.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer overflow or wraparound
Affected products: vendor: jkuhlmann
product: cgltf
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.4
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Ana Kapulica
Published: 2026-03-23T15:50:44.296Z
CVE-2026-32846 OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read
OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: OpenClaw
product: OpenClaw
default_status: unaffected
Credits: lang: en
value: Zhijie Zhang
lang: en
value: VulnCheck
Published: 2026-03-26T16:36:00.657Z
CVE-2026-32847 DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py
DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to the GET /{full_path:path} endpoint. Attackers can bypass Starlette's path normalization by encoding slashes as %2F and dots as %2E%2E, causing the joined path to traverse outside FRONTEND_DIST and exposing sensitive files such as SSH private keys, TLS certificates, and application secrets with a single HTTP request.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: HKUDS
product: DeepCode
default_status: affected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Credits: lang: en
value: YU SUN
Published: 2026-05-28T19:32:13.224Z
CVE-2026-32848 NetBSD cryptodev Race Condition Double-Free via cryptodev_op()
NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit mutable per-operation state embedded in the csession struct to corrupt kernel heap memory.
Problem types: cwe_id: CWE-415
description: Double Free
cwe_id: CWE-362
description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: NetBSD
product: src
default_status: affected
CVSS v3.1: attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
version: 3.1
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Credits: lang: en
value: nasm
lang: en
value: VulnCheck
Published: 2026-05-18T17:52:55.753Z
CVE-2026-32849 NetBSD Signed Integer Overflow in cryptodev_op via cryptodev.c
NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX. A local attacker with access to /dev/crypto and a compression session type can exploit this vulnerability by providing a dst_len value exceeding INT_MAX to trigger a kernel panic through NULL pointer dereference when CONFIG_SVS is disabled and corrupted UIO pointer arithmetic.
Problem types: cwe_id: CWE-190
description: Integer Overflow or Wraparound
cwe_id: CWE-476
description: NULL Pointer Dereference
Affected products: vendor: NetBSD
product: src
default_status: affected
CVSS v3.1: attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Credits: lang: en
value: nasm
lang: en
value: VulnCheck
Published: 2026-05-18T17:42:29.642Z
CVE-2026-32850 MailEnable < 10.55 Reflected XSS via ManageShares.aspx SelectedIndex Parameter
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the SelectedIndex parameter in the ManageShares.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MailEnable
product: MailEnable
default_status: unaffected
Credits: lang: en
value: Egidio Romano
Published: 2026-03-23T19:06:09.045Z
CVE-2026-32851 MailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MailEnable
product: MailEnable
default_status: unaffected
Credits: lang: en
value: Egidio Romano
Published: 2026-03-23T19:06:27.131Z
CVE-2026-32852 MailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter
MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the StartDate parameter in the FreeBusy.aspx form, which is not properly sanitized before being embedded into dynamically generated JavaScript.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MailEnable
product: MailEnable
default_status: unaffected
Credits: lang: en
value: Egidio Romano
Published: 2026-03-23T19:06:41.939Z
CVE-2026-32853 LibVNCServer UltraZip Encoding Heap Out-of-bounds Read
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds read
Affected products: vendor: LibVNC
product: LibVNCServer
default_status: unaffected
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-03-24T17:30:40.061Z
CVE-2026-32854 LibVNCServer httpd proxy NULL Pointer Dereference
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL pointer dereference
Affected products: vendor: LibVNC
product: LibVNCServer
default_status: unaffected
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-03-24T17:31:32.011Z
CVE-2026-32857 Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation
Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the initial user-supplied URL and not to subsequent redirect destinations. Attackers can supply an externally valid URL that passes validation and returns an HTTP redirect to an internal or restricted resource, allowing the browser to follow the redirect and fetch the final destination without revalidation, thereby gaining access to internal network services and sensitive endpoints. This issue is distinct from CVE-2024-56800, which describes redirect-based SSRF generally. This vulnerability specifically arises from a post-redirect enforcement gap in implemented SSRF protections, where validation is applied only to the initial request and not to the final redirected destination.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side request forgery (SSRF)
Affected products: vendor: Firecrawl
product: Firecrawl
default_status: unknown
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Credits: lang: en
value: Eran Shimony, Palo Alto Networks
Published: 2026-03-26T17:29:34.653Z
CVE-2026-32859 ByteDance DeerFlow Stored XSS via Inline Artifact Rendering
ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the browser context when users view artifacts, leading to session compromise, credential theft, and arbitrary script execution.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: Bytedance Inc.
product: DeerFlow
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Chia Min Jun Lennon
Published: 2026-03-27T13:41:22.077Z
CVE-2026-32860 Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvlib file
There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVLIB file in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .lvlib file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.
Problem types: cwe_id: CWE-787
description: CWE-787 - Out of Bounds Write
Affected products: vendor: NI
product: LabVIEW
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Rocco Calvi (@TecR0c) with TecSecurity
lang: en
value: TrendAI Zero Day Initiative
Published: 2026-04-07T19:42:36.167Z
CVE-2026-32861 Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvclass file
There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVCLASS file in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .lvclass file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds write
Affected products: vendor: NI
product: LabVIEW
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Rocco Calvi (@TecR0c) with TecSecurity
lang: en
value: TrendAI Zero Day Initiative
Published: 2026-04-07T19:46:45.763Z
CVE-2026-32862 Out-of-Bounds Write in ResFileFactory::InitResourceMgr()
There is a memory corruption vulnerability due to an out-of-bounds write in ResFileFactory::InitResourceMgr() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds write
Affected products: vendor: NI
product: LabVIEW
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Michael Heinzl
Published: 2026-04-07T19:50:36.912Z
CVE-2026-32863 Out-of-Bounds Read in sentry_transaction_context_set_operation()
There is a memory corruption vulnerability due to an out-of-bounds read in sentry_transaction_context_set_operation() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds read
Affected products: vendor: NI
product: LabVIEW
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Michael Heinzl
Published: 2026-04-07T19:53:51.666Z
CVE-2026-32864 Out-of-Bounds Read in mgcore_SH_25_3!aligned_free()
There is a memory corruption vulnerability due to an out-of-bounds read in mgcore_SH_25_3!aligned_free() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds read
Affected products: vendor: NI
product: LabVIEW
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Michael Heinzl
Published: 2026-04-07T19:56:42.923Z
CVE-2026-32865 OPEXUS eComplaint and eCase insecure password reset
OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing security questions are not asked during the process.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-640
description: CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Affected products: vendor: OPEXUS
product: eComplaint
default_status: affected
vendor: OPEXUS
product: eCASE
default_status: affected
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 9.8
attackVector: NETWORK
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: NONE
confidentialityImpact: HIGH
Credits: lang: en
value: Adam Rose, CISA
Published: 2026-03-19T15:47:59.962Z
CVE-2026-32866 OPEXUS eComplaint and eCase stored XSS via profile first and last name
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inject parts of an XSS payload in their first and last name fields. The payload is executed when the user's full name is rendered. The attacker can run script in the context of a victim's session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: OPEXUS
product: eCASE
default_status: affected
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.5
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
integrityImpact: LOW
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: LOW
confidentialityImpact: LOW
Credits: lang: en
value: Adam Rose, CISA
Published: 2026-03-19T15:48:17.289Z