CVE Vulnerability Catalog

@hono/node-server before version 1.19.13 has a path handling inconsistency in serveStatic that allows protected static files to be accessed by using repeated slashes (//) in the request path. Route-based middleware may not match paths with repeated slashes, while serveStatic resolves them as normalized paths, leading to a middleware bypass.

In CI4MS prior to 0.31.4.0, the Pages module does not apply html_purify validation to content fields, allowing stored XSS. An authenticated admin can inject arbitrary JavaScript that executes for every visitor.

In CI4MS before version 0.31.4.0, the ban note parameter in UserController::ajax_blackList_post() is stored unsanitized and rendered into an HTML data-note attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of another admin viewing the user management page.

CI4MS, a CodeIgniter 4-based CMS skeleton, has a vulnerability in the Google Maps iframe setting (cMap field) in compInfosPost(). Despite using strip_tags() and filtering on\w+ event handlers, the srcdoc attribute in <iframe> is not blocked. An attacker with admin settings access can inject a malicious JavaScript payload in the srcdoc attribute, which executes in the context of the parent page for unauthenticated frontend visitors.

CI4MS, a CodeIgniter 4-based CMS skeleton, contains a vulnerability fixed in version 0.31.4.0. Details of the vulnerability are not available in the description.

Wimi Teamwork On-Premises before version 8.2.0 has an IDOR vulnerability in the preview.php endpoint where the item_id parameter lacks authorization checks, allowing attackers to enumerate IDs and access image previews from other users' conversations.

A vulnerability in the Linux kernel's ATM driver (sigd_send path) allows an unvalidated vcc pointer from userspace to be dereferenced, causing a crash. A malicious process can forge the pointer via sendmsg(), leading to memory corruption.

The Page Builder: Pagelayer plugin for WordPress up to version 2.0.8 contains a Stored XSS vulnerability via the Custom Attributes field in the Button widget. The XSS filtering function does not block all event handlers, allowing attackers with contributor-level access or higher to inject scripts.

A container privilege escalation flaw was found in certain Red Hat Process Automation Manager images. The /etc/passwd file is created with group-writable permissions during build time. An attacker with command execution in the container, even as non-root, can leverage root group membership to modify /etc/passwd and add a user with UID 0, gaining full root privileges.

A container privilege escalation flaw was found in certain OpenShift Update Service (OSUS) images. The /etc/passwd file is created with group-writable permissions during build time. An attacker with command execution in the container, even as non-root, can leverage root group membership to modify /etc/passwd and add a user with UID 0, gaining full root privileges.

A container privilege escalation flaw was found in Web Terminal images. The /etc/passwd file was created with group-writable permissions during build. An attacker with command execution in the container (even as non-root) can leverage root group membership to modify /etc/passwd and add a user with arbitrary UID, including 0, gaining full root privileges.

In Multicluster Engine for Kubernetes images, the /etc/passwd file is created with group-writable permissions. An attacker with container access, even as non-root, who is a member of the root group can modify this file and add a user with any UID, including 0, gaining full root privileges in the container.

A container privilege escalation flaw was found in Ansible Automation Platform images. The /etc/passwd file was created with group-writable permissions during build. An attacker with command execution in the container (even as non-root) can leverage root group membership to modify /etc/passwd and add a user with arbitrary UID, including 0, gaining full root privileges.

Pretix 2025 introduces a new API endpoint that returns check-in data for all events of an organizer instead of a specific event. This allows unauthorized users to access check-in information for other events.

CoolerControl/coolercontrold before version 4.0.0 has a CORS misconfiguration, allowing unauthenticated remote attackers to read data and send commands to the service via malicious websites.

In CoolerControl/coolercontrold before version 4.0.0, unauthenticated functionality allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests.

Incorrect privilege assignment in Dell PowerScale OneFS versions 9.5.0.0-9.10.1.6 and 9.11.0.0-9.13.0.1 allows a low-privileged local attacker to escalate privileges.

A vulnerability in Dell PowerScale OneFS causes error messages to contain sensitive information. Versions 9.5.0.0 through 9.10.1.6 and 9.11.0.0 through 9.13.0.0 are affected.

The Beaver Builder Page Builder plugin for WordPress up to version 2.10.1.1 has a stored XSS vulnerability via the 'settings[js]' parameter. Authenticated attackers with author-level access can inject arbitrary scripts that execute when a page is visited.

The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 'membership_ids[]' parameter in all versions up to and including 5.1.2. Insufficient escaping and preparation on the SQL query allows authenticated attackers (Subscriber-level and above) to append additional SQL queries.