CVE Vulnerability Catalog

A cross-site scripting vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /subject.php file. An unknown function allows manipulation of the subject argument, enabling script injection. The attack can be performed remotely and the exploit is publicly available.

A cross-site scripting vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /forsubject.php. An unknown function mishandles the subject argument, allowing injection of malicious scripts. The attack can be performed remotely and the exploit has been publicly disclosed.

In ChurchCRM prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse 'has any admin permission' gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Module Title' parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping.

The Smart Slider 3 plugin for WordPress up to version 3.5.1.37 inclusive is vulnerable to Sensitive Information Exposure via the 'keyword' parameter. This allows authenticated attackers with contributor-level access or higher to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts from any user, including Administrators and Editors.

Cross-site scripting vulnerability in phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The validation functions fail to detect a scheme when the input starts with an ASCII control character or space, enabling code injection.

Laravel-Mediable before version 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements.

A vulnerability in Firefox for iOS allowed malicious page titles to overwrite saved PDF files or bundled content within the application sandbox. This issue was fixed in version 152.4.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows a remote unauthenticated attacker to read JSON files outside shared folders by manipulating the 'lang' query parameter. Exploitation is limited to files with a narrow naming and format pattern, reducing practical impact.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows XSS attacks due to improper escaping of file names in the basic web listing. An attacker with upload permissions or an anonymous user can upload a file with a malicious name that executes a script in the victim's browser.

Rejetto HFS versions 3.0.0 through 3.2.0 return observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows state-changing API requests via the GET method, which is exempt from anti-CSRF header checks. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed.

Blender 3.0.0 through 5.1.2 has an out-of-bounds read vulnerability via a crafted .blend file with a malicious member_index in the SDNA block. Missing bounds validation causes a crash (SIGSEGV) or heap memory disclosure.

In the Linux kernel vsock/virtio driver, there is a bug in zerocopy handling for large messages fragmented into multiple skbs. The uarg object is allocated only for the last skb, causing missing completion notifications for earlier skbs and potential page leak if the loop breaks early.

In the Linux kernel, a memory leak exists in the hci_le_big_terminate() function. The function allocates iso_list_data but fails to free it in an early return path when neither pa_sync_term nor big_sync_term flags are set.

A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/accept.php. An attacker can remotely manipulate the appid argument, leading to SQL injection. The exploit is publicly available.

A vulnerability in the Tempo Operator's gateway component causes inconsistent namespace-scoped redaction in query API responses when RBAC is enabled. This allows an authenticated user to read span attributes belonging to other tenants' namespaces.

A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/deletemp.php. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly disclosed.

A vulnerability in Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19 fails to check the manage_shared_channels permission in the /share-channel autocomplete handler. This allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash command autocomplete.