A lot of vulnerabilities are basically the same thing. From what I've seen, even legitimate researchers will have form reports. It's just an obvious optimization.

From there it's pretty easy to see that "vulnerability spam" would be a thing.