# Deepinfo Score: High Privileges Required CVEs whose Deepinfo score says the attacker needs high privileges. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-privileges-required/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose Deepinfo score says the attacker needs high privileges. Example 9 of 22 in **Filters › Deepinfo Score** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `enrichment.vdeep_metric.cvss_data.privileges_required` · `operator` `eq` `enrichment.vdeep_metric.cvss_data.privileges_required` is the privileges the attacker needs (`NONE`, `LOW` or `HIGH`), in the Deepinfo score (`enrichment.vdeep_metric`: the CVSS metric Deepinfo uses for the CVE, from the newest CVSS version it has). `eq` matches the exact value `HIGH`. In the response, look at `results[].enrichment.vdeep_metric.cvss_data.privileges_required`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `enrichment.vdeep_metric.cvss_data.privileges_required` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `HIGH` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "enrichment.vdeep_metric.cvss_data.privileges_required", "type": "eq", "value": "HIGH" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].enrichment.cwe[].capec_id: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 25009, "results": [ { "id": "CVE-2026-92860", "source_identifier": "user@vuldb.com", "published": "2026-09-17T12:18:29Z", "last_modified": "2026-09-19T03:17:17Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. The attack may be performed from remote. Upgrading the affected component is advised." } ], "references": [ { "url": "https://github.com/rcourtman/Pulse/", "source": "user@vuldb.com", "tags": null }, { "url": "https://github.com/rcourtman/Pulse/releases/tag/v6.1.0", "source": "user@vuldb.com", "tags": null }, { "url": "https://github.com/rcourtman/Pulse/security/advisories/GHSA-rr3f-jjrr-3qxv", "source": "user@vuldb.com", "tags": null }, { "url": "https://vuldb.com/cve/CVE-2026-92860", "source": "user@vuldb.com", "tags": null }, { "url": "https://vuldb.com/submit/941807", "source": "user@vuldb.com", "tags": null }, { "url": "https://vuldb.com/vuln/406309", "source": "user@vuldb.com", "tags": null }, { "url": "https://vuldb.com/vuln/406309/cti", "source": "user@vuldb.com", "tags": null }, { "url": "https://github.com/rcourtman/Pulse/security/advisories/GHSA-rr3f-jjrr-3qxv", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": null } ], "metrics": { "cvss_metric_v40": [ { "source": "user@vuldb.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "HIGH", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.4, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@vuldb.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "HIGH", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.1, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.3, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@vuldb.com", "type": "Secondary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:M/C:C/I:C/A:C", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "MULTIPLE", "confidentiality_impact": "COMPLETE", "integrity_impact": "COMPLETE", "availability_impact": "COMPLETE", "base_score": 8.3, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 6.4, "impact_score": 10.0, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@vuldb.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-20" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 20, "owasptop10_2021": "A03 Injection", "name": "Improper Input Validation", "description": "The product receives input or data, but it does\n not validate or incorrectly validates that the input has the\n properties that are required to process the data safely and\n correctly.", "capec_id": [ 3, 7, 8, 9, 10, 13, 14, 22, 23, 24 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "Execute Unauthorized Code or Commands", "Modify Memory", "Read Files or Directories", "Read Memory" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Fuzzing", "Manual Static Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.00466, "percentile": 0.39436, "date": "2026-09-21" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0", "3.1", "2.0" ], "source": "user@vuldb.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "HIGH", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.4, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-9177", "source_identifier": "1c6b5737-9389-4011-8117-89fa251edfb2", "published": "2026-07-29T14:16:35Z", "last_modified": "2026-07-30T20:27:10Z", "status": "Awaiting Analysis", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A Server-Side Template Injection (SSTI) vulnerability was identified \nin the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This \nflaw \nallows an attacker with admin privileges to inject arbitrary Java code expressions, which are \nexecuted server-side when the template is rendered (i.e., during email \nsending). Successful exploitation of this flaw allows an attacker to \nexecute \narbitrary code on the server that results in full host compromise.\n\n\n\nThis issue affects all Axway SecureTransport versions prior 5.5-20260528 update." } ], "references": [ { "url": "https://docs.hackjiji.org/blog/cve-2026-9177-ssti-in-securetransport-mft-gateway", "source": "1c6b5737-9389-4011-8117-89fa251edfb2", "tags": null }, { "url": "https://support.axway.com/news/4882/lang/en", "source": "1c6b5737-9389-4011-8117-89fa251edfb2", "tags": null }, { "url": "https://www.toreon.com/CVE-2026-9177", "source": "1c6b5737-9389-4011-8117-89fa251edfb2", "tags": null } ], "metrics": { "cvss_metric_v40": [ { "source": "1c6b5737-9389-4011-8117-89fa251edfb2", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "HIGH", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.4, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": null, "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "1c6b5737-9389-4011-8117-89fa251edfb2", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-1336" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 1336, "owasptop10_2021": null, "name": "Improper Neutralization of Special Elements Used in a Template Engine", "description": "The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.", "capec_id": null, "scope": [ "Integrity" ], "impact": [ "Execute Unauthorized Code or Commands" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00288, "percentile": 0.21594, "date": "2026-09-21" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0" ], "source": "1c6b5737-9389-4011-8117-89fa251edfb2", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "HIGH", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.4, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-88857", "source_identifier": "user@joomla.org", "published": "2026-09-20T18:16:54Z", "last_modified": "2026-09-22T19:34:57Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitisation of any kind. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path." } ], "references": [ { "url": "https://www.OrdaSoft.com/", "source": "user@joomla.org", "tags": null } ], "metrics": { "cvss_metric_v40": [ { "source": "user@joomla.org", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "HIGH", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.4, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": null, "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@joomla.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-434" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 434, "owasptop10_2021": "A04 Insecure Design", "name": "Unrestricted Upload of File with Dangerous Type", "description": "The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.", "capec_id": [ 1 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "Execute Unauthorized Code or Commands" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.00467, "percentile": 0.39658, "date": "2026-09-22" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0" ], "source": "user@joomla.org", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "HIGH", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.4, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [Deepinfo Score: Attack Requirements Present](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-requirements/) - [Deepinfo Score: User Interaction Required](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-user-interaction/) - [Deepinfo Score: High Attack Complexity](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-complexity/) - [Deepinfo Score: Complete Confidentiality Impact](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vulnerable-system-confidentiality/) - [Deepinfo Score: Physical Attack Vector](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-vector/) - [Deepinfo Score: Low Integrity Impact](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vulnerable-system-integrity/)