CVE Vulnerability Catalog

Wikidforum 2.20 has a cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts via the reply_text parameter in the rpc.php endpoint. Scripts execute in other users' browsers when viewing forum replies.

Mermaid, a JavaScript diagramming tool, has a CSS injection vulnerability in its default configuration prior to versions 10.9.6 and 11.15.0. The fontFamily, themeCSS, and altFontFamily options allow injecting CSS that escapes the #mermaid-xxx scoping, enabling page defacement and DOM attribute exfiltration via :has() selectors.

Mermaid before versions 10.9.6 and 11.15.0 is vulnerable to a denial-of-service attack when rendering Gantt charts if the excludes attribute is used to exclude all dates.

In the Indian Motorcycle Scout Bobber + Tech 2025 model, improper handling of physical conditions in the bike-shutdown control allows a physical attacker with access to the WCM wiring harness to bypass the anti-theft shutdown. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit condition; interrupting the relevant wires leaves the motorcycle fully operable even without PIN validation.

In the Indian Motorcycle Scout Bobber + Tech (2025 model year), an expected behavior violation in the in-vehicle network allows an adjacent-network attacker to bypass the anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. By injecting CAN error frames, the attacker causes the WCM to stop transmitting all messages, including the shutdown command. Other ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated without unlocking the immobilizer.

In WWBN AVideo version 29.0 and earlier, the endpoint plugin/AuthorizeNet/processPayment.json.php credits the user's wallet based solely on the attacker-controlled amount parameter, without validating any Authorize.Net transaction. This allows any logged-in user to add arbitrary funds to their AVideo wallet.

WWBN AVideo in version 29.0 and earlier stores category descriptions from user input and renders them as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected page. This is a stored XSS vulnerability in the category description field.

WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.

In WWBN AVideo (version 29.0 and earlier), view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.

In WWBN AVideo 29.0 and earlier, the file objects/mention.json.php lacks authentication checks or an admin gate. It only has a simple entry guard: preg_match('/^@/', $_REQUEST['term']) and a hard-coded rowCount=10. This allows unauthenticated user enumeration.

WWBN AVideo in version 29.0 and earlier does not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE in EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations. This opens a DNS-rebinding TOCTOU vulnerability.

WWBN AVideo version 29.0 and earlier contains a cross-site request forgery (CSRF) vulnerability in the 2FA toggle. An attacker can use a hidden form or fetch request without credentials to disable the victim's 2FA with a single POST request.

In n8n-MCP prior to 2.51.3, the workflow telemetry sanitizer could retain partial fragments of URL-shaped node parameters, such as customer identifiers or secrets in query strings, before sending data to the anonymous telemetry backend. This is fixed in version 2.51.3.

WWBN AVideo in version 29.0 and earlier has a stored cross-site scripting vulnerability in the Live plugin. The YouTube-style view renders the live stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing " plus an event handler via plugin/Live/saveLive.php, and any visitor opening the stream's page executes attacker JavaScript in the platform origin.

In DreamMaker by Interinfo, a Path Traversal vulnerability allows unauthenticated remote attackers to read file names under arbitrary paths via Absolute Path Traversal.

DreamMaker by Interinfo has an Arbitrary File Read vulnerability, allowing privileged local attackers to exploit Relative Path Traversal to download arbitrary system files.

A command injection vulnerability was found in TRENDnet TEW-432BRP firmware 3.10B20 in the formWPS function of /goform/formWPS. Manipulating the peerPin argument allows remote command execution. The vendor states the product has been end-of-life for 15 years and will not be patched.

A command injection vulnerability was discovered in TRENDnet TEW-432BRP firmware version 3.10B20. The flaw exists in the formSetRoute function within /goform/formSetRoute, where the ip, mask, and gateway parameters are not properly sanitized. The vendor states the product has been end-of-life for 15 years and will not provide fixes.

In the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025, uncontrolled resource consumption allows an adjacent attacker to permanently immobilize the motorcycle by sending a few crafted frames that trigger an immobilizer lockout without power-cycle reset.

Weak authentication between the Wireless Control Module (WCM) and Engine Control Module (ECM) in the 2025 Indian Motorcycle Scout Bobber + Tech allows an adjacent-network attacker to recover the ECM immobilizer secret by passively observing a single seed/key exchange. The attacker can then start the engine without the original key.