It's reviewed by someone without any knowledge on the exploitable software. And even if it wouldn't take hours to even set up a testing environment, most CVEs d

It's reviewed by someone without any knowledge on the exploitable software. And even if it wouldn't take hours to even set up a testing environment, most CVEs don't include enough information to build an exploit anyway. No need to assume that the reviewers overblow these issues deliberately, there simply isn't anything to meaningfully review in most cases. They can filter out obviously meaningless bullshit, but that's about it. Source: Found a handfull of RCEs for popular PHP projects, some of which have CVEs.