CVE-2020-19909 is everything that is wrong with CVEs
I keep getting emails from India-based "ethical hackers" who ran a vulnerability assessment against some web property and sent me the results.  Then they ask for payment.  I keep reporting them to Google (Gmail IDs) but they keep landing in my inbox.