CVE Vulnerability Catalog

Live Chat Unlimited 2.8.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the chat input field. Attackers can submit payloads containing script tags and event handlers that execute in the admin area, enabling cookie theft or forced redirects to malicious websites.

Contact Form by WD version 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.

Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript by submitting crafted contact form data. Attackers can inject script code through the name, subject, and message parameters in POST requests to /gmusic/zuzconsole/___contact, which executes when administrators view messages in the inbox interface.

A vulnerability was found in keystonejs keystone up to 20260319 in the GraphQL API Endpoint component. Manipulation of unknown code in output-field.ts leads to resource consumption. The attack can be launched remotely and the exploit is public.

HCL iControl is affected by a weak input validation vulnerability. Expected input of a certain type is not properly validated, which may lead to unexpected behavior.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Embedded Sensitive Data. This issue affects WP eMember from n/a through v10.2.2.

Out-of-bounds write vulnerability in Samsung's rlottie library allows buffer overflows. The issue affects versions before commit dcfde72eae1b0464dc0dd760aec00ada6a148635.

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links.

The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN.

In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.

Integer overflow vulnerability in Samsung's rlottie library allows integer attacks. The issue affects versions before commit 21292665023e5074b38254432716866d00f1985f.

Access of uninitialized pointer and uncontrolled recursion vulnerability in Samsung's rlottie library allows pointer manipulation and oversized serialized data payloads. The issue affects versions before commit eae37633fda13ac05b25c6c95aacea4bc33c80a3.

Memory allocation with excessive size value vulnerability in Samsung's rlottie library allows excessive allocation. The issue affects versions before commit 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.

In the Samsung Open Source rlottie library before commit ce72b35a7ad0dded03051d3aa0ef75321c3bd035, there is a stack-based buffer overflow vulnerability allowing buffer overflows.

Uncontrolled recursion vulnerability in Samsung's rlottie library allows oversized serialized data payloads. The issue affects versions before commit e2d19e3b150e0e4a9586fa90b56fd3061cc98945.

Out-of-bounds read vulnerability in Samsung's rlottie library allows buffer overread. The issue affects versions before commit 223a2a41ba4f462e4abe767bebba49a366c9b9fd.

Weak validation logic in device dissociation API routines allows a remote attacker to forcefully unbind unrelated user endpoints, causing severe denial of service.

A vulnerability in incoming VPN network profile processing. Unsafe handling of special characters allows command injection via malicious config files.

Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.