CVE Vulnerability Catalog

A stored cross-site scripting (XSS) vulnerability exists in Kiamo before version 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages.

A security flaw was discovered in GL.iNet GL-RM1, GL-RM10, GL-RM10RC, and GL-RM1PE 1.8.1 in an unknown function of the Factory Reset Handler component. Manipulation results in improper authentication; the attack can be initiated remotely, though complexity is high and exploitation is difficult.

SonicWall SMA1000 series appliances improperly handle Unicode encoding, allowing a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.

A Cross-Site Request Forgery (CSRF) vulnerability in phpBB v3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Panel icon management functionality.

A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

AlanWeb SCADA saves sensitive information, including user credentials, into a log file. Combined with another vulnerability (CVE-2026-34184), an unauthorized user could access this data and gain further authorized access to the system.

In Apache Airflow versions 3.0.0 through 3.1.8, the DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role. This conflicts with the FAB RBAC model, which treats XCom as a separate protected resource.

A vulnerability was found in jeecgboot JimuReport up to 2.3.0 in the DriverManager.getConnection function of the file /drag/onlDragDataSource/testConnection in the Data Source Handler component. Manipulation of the dbUrl argument results in code injection, and the exploit has been made public.

A vulnerability has been found in code-projects Movie Ticketing System 1.0 affecting an unknown function of the file /db/moviedb.sql in the SQL Database Backup File Handler component. Manipulation leads to information disclosure, the attack can be launched remotely, and the exploit has been publicly disclosed.

A security flaw has been discovered in PHPGurukul News Portal Project 4.1. Impacted is an unknown function of the file /admin/check_availability.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

A SQL injection vulnerability was identified in PHPGurukul News Portal Project 4.1 within the file /admin/add-subcategory.php. Manipulation of the sucatdescription argument allows SQL code injection. The attack can be launched remotely, and the exploit is publicly available.

A SQL injection vulnerability was determined in PHPGurukul News Portal Project 4.1 affecting the file /admin/add-subadmins.php. Manipulation of the sadminusername argument causes SQL injection. The attack may be initiated remotely, and the exploit has been publicly disclosed.

In awwaiid mcp-server-taskwarrior up to version 1.0.1, there is a command injection vulnerability in the server.setRequestHandler function of index.ts via the Identifier argument. Local access is required. An exploit is publicly available, and a patch exists.

The Download Manager plugin for WordPress up to version 3.3.52 is vulnerable to Stored XSS via the 'sid' attribute of the 'wpdm_members' shortcode. Insufficient input sanitization and output escaping allow attackers with contributor-level access to inject arbitrary scripts.

The OSM – OpenStreetMap plugin for WordPress up to version 6.1.15 is vulnerable to Stored Cross-Site Scripting via the 'marker_name' and 'file_color_list' shortcode attributes of the [osm_map_v3] shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when a user visits the page.

The Ziggeo plugin for WordPress up to version 3.1.1 lacks authorization in the wp_ajax_ziggeo_ajax handler. It only verifies a nonce, not user capabilities. The nonce is exposed to all logged-in users. Authenticated attackers (Subscriber+) can perform many admin operations like saving translations, managing event templates, modifying SDK settings, and managing notifications.

The Experto Dashboard for WooCommerce plugin for WordPress up to version 1.0.4 is vulnerable to Stored Cross-Site Scripting in settings fields (e.g., Navigation Font Size). Insufficient input sanitization and output escaping allow authenticated attackers with Administrator access to inject scripts that execute on the settings page. This only affects multi-site installations and installations where unfiltered_html is disabled.

The MStore API plugin for WordPress up to version 4.18.3 has an IDOR vulnerability in the update_user_profile() function. An authenticated user with Subscriber access can modify arbitrary meta fields on their account, including sensitive ones like wp_user_level, without proper validation.

In taskflow-ai up to version 2.1.8, an OS command injection vulnerability was found in the terminal_execute component via manipulation in src/mcp/server/handlers.ts. The attack is remotely exploitable. Version 2.1.9 fixes the issue.