CVE Vulnerability Catalog

Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability allowing authenticated administrators to inject malicious scripts through user creation fields. Attackers can insert JavaScript payloads in the First Name, Last Name, and Email fields, which execute when viewing the User List page.

CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability allowing authenticated users with Content Manager access to inject malicious scripts through SVG file uploads. Attackers can upload SVG files with embedded JavaScript, which execute when other authenticated users access the file.

Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability allowing authenticated administrators to inject malicious scripts through the banner management interface. Attackers with admin credentials can inject XSS payloads in the Description field of the Add banner functionality, which execute for all website visitors when they access the home page.

NewsLister contains an authenticated persistent cross-site scripting vulnerability allowing authenticated administrators to inject malicious scripts through the title parameter in the news addition interface. Attackers can inject JavaScript payloads via the title field in the admin panel that execute when news items are viewed by other users.

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.

Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Attackers can paste malicious data exceeding 5000 bytes into the 'Open the following file when done' field to trigger a denial of service condition.

WordPress Plugin BuddyPress 6.2.0 contains a persistent cross-site scripting vulnerability allowing authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. Attackers can inject iframe elements with event handlers that execute when administrators preview or view the affected page content.

Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections. Metric names were not checked for newlines, colons, or pipes, allowing additional metrics to be injected from untrusted sources.

The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf_add_comment' function in all versions up to, and including, 5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to arbitrary collaborations.

Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.

ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem. Certain field configurations accept values beginning with the prefix "func:" which are passed directly into an eval() call inside tagsets/participant.php and tagsets/options.php.

phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any authenticated user, including regular frontend users, to delete arbitrary tags, resulting in permanent data loss.

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypasses sanitization through encode-decode cycles. An authenticated attacker with FAQ_ADD permission can inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.

phpMyFAQ before 4.1.2 contains a stored XSS vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser, including administrators.

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.

Vvveb CMS before 1.0.8.3 contains an unauthenticated reflected XSS issue in the public product return form. The customer_order_id POST parameter is inserted into the "Order %s not found!" error message without HTML escaping, allowing attacker-controlled JavaScript to execute in the submitting user's browser.

Vvveb, a CMS with a page builder, contains a vulnerability in versions prior to 1.0.8.3. Technical details were not provided in the description. The vulnerability is fixed in 1.0.8.3.

phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that only checks login status instead of backend privileges. Authenticated ordinary users can access sensitive backend operational information such as dashboard versions, LDAP configuration, Elasticsearch statistics, and health-check data.

phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../<path> in the client URL parameter to recursively delete directories outside the intended clientFolder scope.

phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermission(CONFIGURATION_EDIT). Any authenticated user can enumerate system configuration metadata including permission model, cache backend, mail provider, and translation provider, violating least privilege.