Threats tagged 'ghsa-3fmp-59v6-4qw2'

An unauthenticated improper input validation vulnerability exists in the POST /fetch_cve_data endpoint of cve-search. A remote attacker can manipulate request parameters to access arbitrary MongoDB collections, potentially exposing sensitive data such as administrative usernames and password hashes. This exposure enables offline password cracking and possible administrative account compromise.