stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2019-15553 (severity: HIGH, weakness: CWE-908)
An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
CVE-2019-15554 (severity: CRITICAL, weakness: CWE-787)
An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity.
CVE-2019-15555 (severity: CRITICAL, weakness: CWE-89)
FredReinink Wellness-app before 2019-06-19 allows SQL injection, related to dietTrack.php, exerciseGenerator.php, fitnessTrack.php, and server.php.
CVE-2019-15556 (severity: CRITICAL, weakness: CWE-89)
Pvanloon1983 social_network before 2019-07-03 allows SQL injection in includes/form_handlers/register_handler.php.
CVE-2019-15557 (severity: CRITICAL, weakness: CWE-89)
XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key.
CVE-2019-15558 (severity: CRITICAL, weakness: CWE-89)
XM^online 2 Common Utils and Endpoints 0.2.1 allows SQL injection, related to Constants.java, DropSchemaResolver.java, and SchemaChangeResolver.java.
CVE-2019-15559 (severity: CRITICAL, weakness: CWE-89)
DianoxDragon Hawn before 2019-07-10 allows SQL injection.
CVE-2019-15560 (severity: CRITICAL, weakness: CWE-89)
The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js.
CVE-2019-15561 (severity: CRITICAL, weakness: CWE-89)
FlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js.
CVE-2019-15562 (severity: CRITICAL, weakness: CWE-89)
GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm
CVE-2019-15563 (severity: CRITICAL, weakness: CWE-89)
Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in FeatureExtractionService.java.
CVE-2019-15564 (severity: CRITICAL, weakness: CWE-89)
The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py.
CVE-2019-15565 (severity: CRITICAL, weakness: CWE-89)
The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php.
CVE-2019-15566 (severity: CRITICAL, weakness: CWE-89)
The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.
CVE-2019-15567 (severity: CRITICAL, weakness: CWE-89)
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature.
CVE-2019-15568 (severity: CRITICAL, weakness: CWE-89)
idseq-web before 2019-07-01 in Infectious Disease Sequencing Platform IDseq allows SQL injection via tax_levels.
CVE-2019-15569 (severity: CRITICAL, weakness: CWE-89)
HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirection.java.
CVE-2019-15570 (severity: CRITICAL, weakness: CWE-89)
BEdita through 4.0.0-RC2 allows SQL injection during a save operation for a relation with parameters.
CVE-2019-15571 (severity: CRITICAL, weakness: CWE-89)
The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.
CVE-2019-15572 (severity: CRITICAL, weakness: CWE-89)
Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php.
CVE-2019-15573 (severity: CRITICAL, weakness: CWE-89)
Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php.
CVE-2019-15574 (severity: CRITICAL, weakness: CWE-89)
Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php.
CVE-2019-15575 (severity: HIGH, weakness: CWE-77)
A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope.
CVE-2019-15576 (severity: HIGH, weakness: CWE-200)
An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint.
CVE-2019-15577 (severity: MEDIUM, weakness: CWE-200)
An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups browsing.
CVE-2019-15578 (severity: MEDIUM, weakness: CWE-200)
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.
CVE-2019-15579 (severity: MEDIUM, weakness: CWE-200)
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a confidential issue in a private project would be disclosed to a guest via milestones.
CVE-2019-15580 (severity: MEDIUM, weakness: CWE-201)
An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.
CVE-2019-15581 (severity: MEDIUM, weakness: CWE-639)
An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules.
CVE-2019-15582 (severity: MEDIUM, weakness: CWE-639)
An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a protected environment.
CVE-2019-15583 (severity: HIGH, weakness: CWE-200)
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.
CVE-2019-15584 (severity: MEDIUM, weakness: CWE-400)
A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.
CVE-2019-15585 (severity: CRITICAL, weakness: CWE-287)
Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account.
CVE-2019-15586 (severity: MEDIUM, weakness: CWE-79)
A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.
CVE-2019-15587 (severity: MEDIUM, weakness: CWE-79)
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
CVE-2019-15588 (severity: HIGH, weakness: CWE-77)
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.
CVE-2019-15589 (severity: HIGH, weakness: CWE-284)
An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before.
CVE-2019-1559 (severity: MEDIUM, weakness: CWE-203)
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
CVE-2019-15590 (severity: HIGH, weakness: CWE-284)
An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration
CVE-2019-15591 (severity: MEDIUM, weakness: CWE-284)
An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.
CVE-2019-15592 (severity: MEDIUM, weakness: CWE-200)
GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.
CVE-2019-15593 (severity: MEDIUM, weakness: CWE-400)
GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.
CVE-2019-15594 (severity: MEDIUM, weakness: CWE-200)
GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.
CVE-2019-15595 (severity: HIGH, weakness: CWE-77)
A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands.
CVE-2019-15596 (severity: HIGH, weakness: CWE-22)
A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory.
CVE-2019-15597 (severity: CRITICAL, weakness: CWE-94)
A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.
CVE-2019-15598 (severity: CRITICAL, weakness: CWE-94)
A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
CVE-2019-15599 (severity: CRITICAL, weakness: CWE-94)
A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
CVE-2019-15600 (severity: HIGH, weakness: CWE-22)
A Path traversal exists in http_server which allows an attacker to read arbitrary system files.
CVE-2019-15602 (severity: MEDIUM, weakness: CWE-79)
The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.
CVE-2019-15603 (severity: MEDIUM, weakness: CWE-79)
The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing.
CVE-2019-15604 (severity: HIGH, weakness: CWE-295)
Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate
CVE-2019-15605 (severity: CRITICAL, weakness: CWE-444)
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVE-2019-15606 (severity: CRITICAL, weakness: CWE-20)
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
CVE-2019-15607 (severity: MEDIUM, weakness: CWE-79)
A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc.
CVE-2019-15608 (severity: MEDIUM, weakness: CWE-840)
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
CVE-2019-15609 (severity: CRITICAL, weakness: CWE-77)
The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.
CVE-2019-15610 (severity: MEDIUM, weakness: CWE-285)
Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.
CVE-2019-15611 (severity: MEDIUM, weakness: CWE-657)
Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications.
CVE-2019-15612 (severity: MEDIUM, weakness: CWE-384)
A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.
CVE-2019-15613 (severity: HIGH, weakness: CWE-20)
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
CVE-2019-15614 (severity: MEDIUM, weakness: CWE-79)
Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.
CVE-2019-15615 (severity: MEDIUM, weakness: CWE-284)
A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past.
CVE-2019-15616 (severity: MEDIUM, weakness: CWE-93)
Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.
CVE-2019-15617 (severity: MEDIUM, weakness: CWE-287)
A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.
CVE-2019-15618 (severity: MEDIUM, weakness: CWE-79)
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
CVE-2019-15619 (severity: MEDIUM, weakness: CWE-79)
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
CVE-2019-15620 (severity: LOW, weakness: CWE-287)
Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature.
CVE-2019-15621 (severity: MEDIUM, weakness: CWE-281)
Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link.
CVE-2019-15622 (severity: LOW, weakness: CWE-89)
Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.
CVE-2019-15623 (severity: MEDIUM, weakness: CWE-359)
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.
CVE-2019-15624 (severity: MEDIUM, weakness: CWE-20)
Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.
CVE-2019-15625 (severity: MEDIUM, weakness: NVD-CWE-Other)
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-15626 (severity: HIGH, weakness: CWE-319)
The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or availability.
CVE-2019-15627 (severity: HIGH, weakness: CWE-59)
Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. Local OS access is required. Please note that only Windows agents are affected.
CVE-2019-15628 (severity: HIGH, weakness: CWE-426)
Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use a specific service as an execution and/or persistence mechanism which could execute a malicious program each time the service is started.
CVE-2019-15629 (severity: HIGH, weakness: NVD-CWE-Other)
Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG_MISUSE vulnerability that could be exploited to allow the application to share information to third-party applications on the device.
CVE-2019-1563 (severity: LOW, weakness: CWE-203)
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
CVE-2019-15630 (severity: HIGH, weakness: CWE-22)
Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process.
CVE-2019-15631 (severity: CRITICAL, weakness: NVD-CWE-Other)
Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrary code.
CVE-2019-15635 (severity: MEDIUM, weakness: CWE-319)
An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save the credentials is generated, and the password can be revealed by simply checking the "Show password" box.
CVE-2019-15637 (severity: HIGH, weakness: CWE-611)
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.
CVE-2019-15638 (severity: HIGH, weakness: CWE-427)
COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element.
CVE-2019-15639 (severity: HIGH, weakness: CWE-20)
main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.
CVE-2019-15640 (severity: HIGH, weakness: CWE-20)
Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.
CVE-2019-15641 (severity: MEDIUM, weakness: CWE-611)
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.
CVE-2019-15642 (severity: HIGH, weakness: CWE-94)
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."
CVE-2019-15643 (severity: MEDIUM, weakness: CWE-79)
The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.
CVE-2019-15644 (severity: MEDIUM, weakness: CWE-79)
The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
CVE-2019-15645 (severity: HIGH, weakness: CWE-352)
The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
CVE-2019-15646 (severity: CRITICAL, weakness: CWE-89)
The rsvpmaker plugin before 6.2 for WordPress has SQL injection.
CVE-2019-15647 (severity: HIGH, weakness: CWE-94)
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.
CVE-2019-15648 (severity: MEDIUM, weakness: CWE-22)
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
CVE-2019-15649 (severity: HIGH, weakness: CWE-434)
The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.
CVE-2019-1565 (severity: MEDIUM, weakness: CWE-79)
The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML.
CVE-2019-15650 (severity: MEDIUM, weakness: NVD-CWE-Other)
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.
CVE-2019-15651 (severity: CRITICAL, weakness: CWE-125)
wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is mishandled for a crafted DER certificate in GetLength_ex.
CVE-2019-15652 (severity: MEDIUM, weakness: CWE-79)
The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, leading to the ability to inject client-side code.
CVE-2019-15653 (severity: HIGH, weakness: CWE-311)
Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username are password values are a double md5 of the plaintext real value, i.e., md5(md5(value)).
CVE-2019-15654 (severity: HIGH, weakness: CWE-306)
Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login information is stored in cleartext.
CVE-2019-15655 (severity: HIGH, weakness: CWE-306)
D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext.
CVE-2019-15656 (severity: HIGH, weakness: CWE-200)
D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on the web management server because of username_v and password_v variables.
CVE-2019-15657 (severity: CRITICAL, weakness: NVD-CWE-Other)
In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.
CVE-2019-15658 (severity: HIGH, weakness: CWE-89)
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.
CVE-2019-15659 (severity: CRITICAL, weakness: CWE-89)
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.