Looking at the software they exploited... The first one looks like a student project? https://www.sourcecodester.com/php/17115/travel-journal-using-php-and-mys

Looking at the software they exploited... The first one looks like a student project? https://www.sourcecodester.com/php/17115/travel-journal-using-php-and-mysql-source-code.html https://www.sourcecodester.com/php/17115/travel-journal-usin... I see 79 lines of PHP code. It has two buttons, "read journal" and "write journal", to make a plain-text post. How did this get a CVE assigned? The next two are from a CMS with a README in Lithuanian, 2 stars, and a dead website. I don't want to dunk on all those projects, and maybe those kinds of programs are the bulk of CVEs, but they managed to find projects that did absolutely no validation and which can get a XSS/CSRF/SQLi on the first attempt (just put some JS or SQL into any form field and you've won). Is that really a random selection of 14 CVEs? Also why does the table have 14 when the text claims 15?