CVE Vulnerability Catalog

Vvveb before version 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer. Attackers can exploit the 'r' query parameter and '_component_ajax' POST parameter to inject and execute arbitrary JavaScript in the context of the Vvveb origin.

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. Attackers can access the cron controller without authentication and retrieve the exposed secret key from the response, enabling them to trigger scheduled task execution outside of the intended schedule.

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource).

A security flaw has been discovered in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the file /askquery.php. The manipulation of the argument squeryx results in SQL injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

i18nextify to biblioteka JavaScript, która umożliwia internacjonalizację stron internetowych bez zmian w kodzie źródłowym. W wersjach przed 4.0.8, tokeny interpolacji {{key}} w atrybutach src i href są zastępowane surowym ciągiem zwracanym przez i18next.t(), co może prowadzić do wstrzyknięcia niebezpiecznych wartości, takich jak javascript:alert(1).

i18nextify to biblioteka JavaScript, która umożliwia internacjonalizację stron internetowych bez zmian w kodzie źródłowym. W wersjach przed 3.0.5 wartości lng i ns są interpolowane bez odpowiedniego kodowania, walidacji lub sanitizacji, co pozwala na wstrzykiwanie złośliwych danych przez użytkowników.

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as ticket creation or updates.

A security flaw was discovered in OSGeo gdal up to 3.13.0dev-4 in the GDnentries function of frmts/hdf4/hdf-eos/GDapi.c. Manipulation of the DataFieldName argument results in a heap-based buffer overflow, and the attack requires local access.

manage.get.gov is the .gov TLD registrar maintained by CISA, allowing an organization administrator to assign domain manager privileges for domains not already in another organization.

In the ParquetSharp library (from version 18.1.0 to before 23.0.0.1), the DecimalConverter.ReadDecimal function performs a stackalloc using a potentially attacker-supplied value. Declaring a decimal column with an unreasonable width could lead to a stack overflow. In a service environment, this could potentially take down a service.

PJSIP prior to version 2.17, on GnuTLS builds, can accept SIP TLS transport (sip_transport_tls) connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via verify_server = PJ_TRUE or verify_client = PJ_TRUE.

If a trusted template author writes a <script> tag with an empty 'type' attribute or a 'type' attribute containing ASCII whitespace, template execution incorrectly escapes data passed into the <script> block. This may lead to unintended JavaScript execution.

Go's ReverseProxy can forward queries containing parameters not visible to Rewrite functions. It does not account for ParseQuery's limit on total query parameters (GODEBUG=urlmaxqueryparams=N), allowing a request with a hidden parameter such as hidden=y to be forwarded while hidden from the Rewrite function.

The vulnerability fixed in CVE-2026-27142 involved incorrect escaping of URLs inside a <meta> tag's <content> attribute. If the URL content inserted ASCII whitespaces around the '=' rune, the escaper would fail to escape it, leading to XSS.

A vulnerability was identified in OSGeo GDAL up to 3.13.0dev-4 affecting the SWnentries function in frmts/hdf4/hdf-eos/SWapi.c. Manipulation of the DimensionName argument leads to a heap-based buffer overflow. The attack must be carried out locally, and the exploit is publicly available.

A vulnerability was found in CLIProxyAPI 6.9.29 (router-for-me) in internal/api/handlers/management/api_tools.go of the API interface. Manipulation of the url argument leads to server-side request forgery, exploitable remotely, and the exploit is publicly available.

A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page. An authenticated attacker (patient) can inject a malicious script into the User Name parameter, which is stored and later rendered in the doctor's interface.

A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. Improper file sanitization allows attackers to inject malicious files, leading to RCE.

Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encrypted drive data.

Medtronic MyCareLink Patient Monitor has an internal serial interface that allows an attacker with physical access to reach a login prompt via a UART terminal. The vulnerability requires physical access to the device.