xamxte/cve-to-cwe huggingface dataset:
CVE-2025-8366: A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_lst.php. The manipulation of the argument nome/matricula_servidor leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2018-20014: In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::GetFileHashAndMetadata NULL pointer dereference, leading to shutting down the client application.
CVE-2025-6057: The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2022-37598: Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
CVE-2023-41916:  In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected.  We recommend users upgrade the version of Linkis to version 1.5.0.
CVE-2022-20506: In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of privilege from a guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-226133034
CVE-2008-1144: The Marvell driver for the Netgear WN802T Wi-Fi access point with firmware 1.3.16 on the Marvell 88W8361P-BEM1 chipset does not properly parse EAPoL-Key packets, which allows remote authenticated users to cause a denial of service (device reboot or hang) or possibly execute arbitrary code via a malformed EAPoL-Key packet with a crafted "advertised length."
CVE-2019-9612: An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/upload URI.
CVE-2024-8726: The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2023-24652: Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the Description parameter under the Create ticket function.
CVE-2022-48826: In the Linux kernel, the following vulnerability has been resolved:  drm/vc4: Fix deadlock on DSI device attach error  DSI device attach to DSI host will be done with host device's lock held.  Un-registering host in "device attach" error path (ex: probe retry) will result in deadlock with below call trace and non operational DSI display.  Startup Call trace: [   35.043036]  rt_mutex_slowlock.constprop.21+0x184/0x1b8 [   35.043048]  mutex_lock_nested+0x7c/0xc8 [   35.043060]  device_del+0x4c/0x3e8 [   35.043075]  device_unregister+0x20/0x40 [   35.043082]  mipi_dsi_remove_device_fn+0x18/0x28 [   35.043093]  device_for_each_child+0x68/0xb0 [   35.043105]  mipi_dsi_host_unregister+0x40/0x90 [   35.043115]  vc4_dsi_host_attach+0xf0/0x120 [vc4] [   35.043199]  mipi_dsi_attach+0x30/0x48 [   35.043209]  tc358762_probe+0x128/0x164 [tc358762] [   35.043225]  mipi_dsi_drv_probe+0x28/0x38 [   35.043234]  really_probe+0xc0/0x318 [   35.043244]  __driver_probe_device+0x80/0xe8 [   35.043254]  driver_probe_device+0xb8/0x118 [   35.043263]  __device_attach_driver+0x98/0xe8 [   35.043273]  bus_for_each_drv+0x84/0xd8 [   35.043281]  __device_attach+0xf0/0x150 [   35.043290]  device_initial_probe+0x1c/0x28 [   35.043300]  bus_probe_device+0xa4/0xb0 [   35.043308]  deferred_probe_work_func+0xa0/0xe0 [   35.043318]  process_one_work+0x254/0x700 [   35.043330]  worker_thread+0x4c/0x448 [   35.043339]  kthread+0x19c/0x1a8 [   35.043348]  ret_from_fork+0x10/0x20  Shutdown Call trace: [  365.565417] Call trace: [  365.565423]  __switch_to+0x148/0x200 [  365.565452]  __schedule+0x340/0x9c8 [  365.565467]  schedule+0x48/0x110 [  365.565479]  schedule_timeout+0x3b0/0x448 [  365.565496]  wait_for_completion+0xac/0x138 [  365.565509]  __flush_work+0x218/0x4e0 [  365.565523]  flush_work+0x1c/0x28 [  365.565536]  wait_for_device_probe+0x68/0x158 [  365.565550]  device_shutdown+0x24/0x348 [  365.565561]  kernel_restart_prepare+0x40/0x50 [  365.565578]  kernel_restart+0x20/0x70 [  365.565591]  __do_sys_reboot+0x10c/0x220 [  365.565605]  __arm64_sys_reboot+0x2c/0x38 [  365.565619]  invoke_syscall+0x4c/0x110 [  365.565634]  el0_svc_common.constprop.3+0xfc/0x120 [  365.565648]  do_el0_svc+0x2c/0x90 [  365.565661]  el0_svc+0x4c/0xf0 [  365.565671]  el0t_64_sync_handler+0x90/0xb8 [  365.565682]  el0t_64_sync+0x180/0x184
CVE-2023-0513: A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-219334 is the identifier assigned to this vulnerability.
CVE-2023-4557: A vulnerability classified as critical has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/search_purchase_paymen_report.php. The manipulation of the argument customer leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238158 is the identifier assigned to this vulnerability.
CVE-2010-3480: Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVE-2019-4046: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker could exploit this vulnerability to cause the consumption of Memory. IBM X-Force ID: 156242.
CVE-2019-5355: A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-17400: The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
CVE-2015-3362: Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary web script or HTML via a node title.
CVE-2021-42973: NoMachine Server is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Server above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
CVE-2017-5937: The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.
CVE-2020-19274: A Cross SIte Scripting (XSS) vulnerability exists in Dhcms 2017-09-18 in guestbook via the message board, which could let a remote malicious user execute arbitrary code.
CVE-2009-2150: Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack the authentication of arbitrary users for requests that terminate a session via login/logout.php, and might allow remote attackers to hijack the authentication of certain users via a (2) ADD or (3) DELETE action to enrolments/step2.php.
CVE-2023-53910: WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor. Attackers can submit POST requests to /wbce/modules/wysiwyg/save.php with malicious script content in the content parameter to execute JavaScript when users view the affected page.
CVE-2023-53940: Codigo Markdown Editor 1.0.1 contains a code execution vulnerability that allows attackers to run arbitrary system commands by crafting a malicious markdown file. Attackers can embed a video source with an onerror event that executes shell commands through Node.js child_process module when the file is opened.
CVE-2018-13447: SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
CVE-2019-15971: A vulnerability in the MP3 detection engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper validation of certain MP3 file types. An attacker could exploit this vulnerability by sending a crafted MP3 file through the targeted device. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.
CVE-2019-2000: In several functions of binder.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-120025789.
CVE-2017-10798: In ObjectPlanet Opinio before 7.6.4, there is XSS.
CVE-2021-47222: In the Linux kernel, the following vulnerability has been resolved:  net: bridge: fix vlan tunnel dst refcnt when egressing  The egress tunnel code uses dst_clone() and directly sets the result which is wrong because the entry might have 0 refcnt or be already deleted, causing number of problems. It also triggers the WARN_ON() in dst_hold()[1] when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and checking if a reference was actually taken before setting the dst.  [1] dmesg WARN_ON log and following refcnt errors  WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]  Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net  CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G        W         5.13.0-rc3+ #360  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014  RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]  Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 <0f> 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49  RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000  RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0  RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001  R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000  R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401  FS:  0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0  Call Trace:   br_handle_vlan+0xbc/0xca [bridge]   __br_forward+0x23/0x164 [bridge]   deliver_clone+0x41/0x48 [bridge]   br_handle_frame_finish+0x36f/0x3aa [bridge]   ? skb_dst+0x2e/0x38 [bridge]   ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge]   ? br_handle_frame_finish+0x3aa/0x3aa [bridge]   br_handle_frame+0x2c3/0x377 [bridge]   ? __skb_pull+0x33/0x51   ? vlan_do_receive+0x4f/0x36a   ? br_handle_frame_finish+0x3aa/0x3aa [bridge]   __netif_receive_skb_core+0x539/0x7c6   ? __list_del_entry_valid+0x16e/0x1c2   __netif_receive_skb_list_core+0x6d/0xd6   netif_receive_skb_list_internal+0x1d9/0x1fa   gro_normal_list+0x22/0x3e   dev_gro_receive+0x55b/0x600   ? detach_buf_split+0x58/0x140   napi_gro_receive+0x94/0x12e   virtnet_poll+0x15d/0x315 [virtio_net]   __napi_poll+0x2c/0x1c9   net_rx_action+0xe6/0x1fb   __do_softirq+0x115/0x2d8   run_ksoftirqd+0x18/0x20   smpboot_thread_fn+0x183/0x19c   ? smpboot_unregister_percpu_thread+0x66/0x66   kthread+0x10a/0x10f   ? kthread_mod_delayed_work+0xb6/0xb6   ret_from_fork+0x22/0x30  ---[ end trace 49f61b07f775fd2b ]---  dst_release: dst:00000000c02d677a refcnt:-1  dst_release underflow
CVE-2025-23680: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Narnoo Operator allows Reflected XSS. This issue affects Narnoo Operator: from n/a through 2.0.0.
CVE-2024-30589: Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability in the entrys parameter of the fromAddressNat function.
CVE-2015-7061: The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7059 and CVE-2015-7060.
CVE-2022-41274: SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can lead to the exposure of data like financial reports.
CVE-2016-5151: PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document, related to fpdfsdk/javascript/JS_Object.cpp and fpdfsdk/javascript/app.cpp.
CVE-2012-3521: Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) geshi-path or (2) geshi-lang-path parameter.
CVE-2021-4181: Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVE-2015-2514: Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2530.
CVE-2015-3923: Coppermine Photo Gallery before 1.5.36 allows remote attackers to enumerate directories via a full path in the folder parameter to minibrowser.php.
CVE-2017-0695: A denial of service vulnerability in the Android media framework. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37094889.
CVE-2021-24291: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)
CVE-2021-25250: An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2025-49284: Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction allows Cross Site Request Forgery. This issue affects WP Maintenance Mode & Site Under Construction: from n/a through 4.3.
CVE-2024-12146: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Finder Fire Safety Finder ERP/CRM (New System) allows SQL Injection.This issue affects Finder ERP/CRM (New System): before 18.12.2024.
CVE-2018-15990: Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2021-25053: The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
CVE-2025-21774: In the Linux kernel, the following vulnerability has been resolved:  can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated  Fix NULL pointer check in rkcanfd_handle_rx_fifo_overflow_int() to bail out if skb cannot be allocated.
CVE-2025-23884: Cross-Site Request Forgery (CSRF) vulnerability in Chris Roberts Annie allows Cross Site Request Forgery.This issue affects Annie: from n/a through 2.1.1.
CVE-2022-31788: IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname.
CVE-2007-5855: Mail in Apple Mac OS X 10.4.11 and 10.5.1, when an SMTP account has been set up using Account Assistant, can use plaintext authentication even when MD5 Challenge-Response authentication is available, which makes it easier for remote attackers to sniff account activity.
CVE-2025-62881: Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.3.
CVE-2021-47277: In the Linux kernel, the following vulnerability has been resolved:  kvm: avoid speculation-based attacks from out-of-range memslot accesses  KVM's mechanism for accessing guest memory translates a guest physical address (gpa) to a host virtual address using the right-shifted gpa (also known as gfn) and a struct kvm_memory_slot.  The translation is performed in __gfn_to_hva_memslot using the following formula:        hva = slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE  It is expected that gfn falls within the boundaries of the guest's physical memory.  However, a guest can access invalid physical addresses in such a way that the gfn is invalid.  __gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first retrieves a memslot through __gfn_to_memslot.  While __gfn_to_memslot does check that the gfn falls within the boundaries of the guest's physical memory or not, a CPU can speculate the result of the check and continue execution speculatively using an illegal gfn. The speculation can result in calculating an out-of-bounds hva.  If the resulting host virtual address is used to load another guest physical address, this is effectively a Spectre gadget consisting of two consecutive reads, the second of which is data dependent on the first.  Right now it's not clear if there are any cases in which this is exploitable.  One interesting case was reported by the original author of this patch, and involves visiting guest page tables on x86.  Right now these are not vulnerable because the hva read goes through get_user(), which contains an LFENCE speculation barrier.  However, there are patches in progress for x86 uaccess.h to mask kernel addresses instead of using LFENCE; once these land, a guest could use speculation to read from the VMM's ring 3 address space.  Other architectures such as ARM already use the address masking method, and would be susceptible to this same kind of data-dependent access gadgets.  Therefore, this patch proactively protects from these attacks by masking out-of-bounds gfns in __gfn_to_hva_memslot, which blocks speculation of invalid hvas.  Sean Christopherson noted that this patch does not cover kvm_read_guest_offset_cached.  This however is limited to a few bytes past the end of the cache, and therefore it is unlikely to be useful in the context of building a chain of data dependent accesses.
CVE-2020-14523: Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.
CVE-2025-27903: IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows transmits data in a cleartext communication channel that could allow an attacker to obtain sensitive information using man in the middle techniques.
CVE-2020-35810: Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, RBK40 before 2.3.5.30, RBR40 before 2.3.5.30, RBS40 before 2.3.5.30, RBK20 before 2.3.5.26, RBR20 before 2.3.5.26, RBS20 before 2.3.5.26, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, XR500 before 2.3.2.56, and XR700 before 1.0.1.10.
CVE-2020-7572: A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser.
CVE-2018-12808: Adobe Acrobat and Reader versions 2018.011.20055 and earlier, 2017.011.30096 and earlier, and 2015.006.30434 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2020-37120: Rubo DICOM Viewer 2.0 contains a buffer overflow vulnerability in the DICOM server name input field that allows attackers to overwrite Structured Exception Handler (SEH). Attackers can craft a malicious text file with carefully constructed payload to execute arbitrary code by overwriting SEH and triggering remote code execution.
CVE-2021-3932: twill is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2024-4928: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /simple-online-bidding-system/admin/ajax.php?action=delete_category. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264464.
CVE-2018-17903: SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to a replay attack and command forgery.
CVE-2024-56035: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kurt Payne Upload Scanner allows Reflected XSS.This issue affects Upload Scanner: from n/a through 1.2.
CVE-2023-34154: Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windows in an arbitrary way, consuming system resources.