CVE Vulnerability Catalog

A cross-site scripting vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 49b20f53. The hidden REST API endpoint at /index.php/api/product/set allows remote XSS via the title/description parameters.

A vulnerability was found in Ecommerce-CodeIgniter-Bootstrap up to commit 95dfa8cebbb87ab46ae450643a07241274a74dce. The setReferrer function in application/core/MY_Controller.php is affected, and manipulation of the href argument leads to an open redirect that can be exploited remotely.

A flaw in RT-Thread up to version 5.2.2 affects the read/write/sys_ioctl functions in components/lwp/lwp_syscall.c. Parameter manipulation can cause a divide-by-zero error, allowing remote attacks. The exploit is published and may be used.

A path traversal vulnerability was found in the Live Webhook Endpoint component of NousResearch hermes-agent up to version 2026.5.16. The extract_media function in gateway/platforms/base.py allows path manipulation, enabling remote attacks.

A security vulnerability was found in NousResearch hermes-agent up to version 0.15.2. The issue affects the DiscordAdapter._is_allowed_user function in the gateway/platforms/discord.py file, leading to improper authentication. The attack can be launched remotely but is difficult to exploit.

A weakness has been identified in NousResearch hermes-agent up to version 2026.4.30 in the function AIAgent.run_conversation of the file run_agent.py of the HTTP API component. Manipulation of the argument todos causes denial of service. The attack can be initiated remotely, and the exploit is publicly available.

A security vulnerability has been found in NousResearch hermes-agent up to version 0.15.2 in the shell.exec function of tui_gateway/server.py. It allows remote bypass of protection mechanisms. The exploit is public and the vendor did not respond.

A vulnerability was found in omec-project amf up to version 2.0.2/2.1.1 in the NGSetupRequest handler function within handler.go. Manipulation of this function allows a remote denial of service (DoS) attack.

A vulnerability was found in omec-project amf up to version 2.1.1 in the RRCInactiveTransitionReport function of the NGAP Message Handler. Remote manipulation can lead to denial of service (DoS). The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the /medicine.php file. An attacker can remotely manipulate the editid argument, leading to unauthorized database access. The exploit has been published and may be used.

A denial of service vulnerability was found in the AMF component of Open5GS up to version 2.7.7. The function amf_nnrf_handle_nf_discover in src/amf/nnrf-handler.c can be exploited remotely to cause a crash. The exploit is publicly available.

An improper access control vulnerability in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.

Insufficient UI warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

A Cross-Site Scripting (XSS) vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. The flaw is due to improper neutralization of input during web page generation.

A Relative Path Traversal vulnerability in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

SSRF (Server-Side Request Forgery) vulnerability occurs during repository migration when the application follows HTTP redirects. An attacker can exploit this flaw to send requests to internal network resources.

An absolute path traversal vulnerability in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

A vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. The issue stems from an operation on a resource after expiration or release.

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.