CVE Vulnerability Catalog

An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

A vulnerability exists in Wikimedia Foundation MediaWiki associated with the includes/Page/Article.php program file. This issue affects MediaWiki from * before 1.43.7, 1.44.4, 1.45.2.

A vulnerability exists in Wikimedia Foundation AbuseFilter affecting versions before 1.43.7, 1.44.4, and 1.45.2. Technical details are not provided in the description.

A cross-site scripting vulnerability was identified in Devs Palace ERP Online up to version 4.0.0 in the file /accounts/chart-save. The attack can be performed remotely and the exploit is publicly available.

In WebAssembly Binaryen up to version 117, the function IRBuilder::makeBrOn in src/wasm/wasm-ir-builder.cpp has a reachable assertion. Manipulation of input can cause a crash. The exploit is publicly available.

A cross-site scripting vulnerability was detected in Devs Palace ERP Online up to version 4.0.0 in the file /accounts/mr-save. The attack can be launched remotely and the exploit is publicly available.

A cross-site scripting vulnerability was found in Devs Palace ERP Online up to version 4.0.0 in the file /inventory/add_new_customer. The attack can be initiated remotely and the exploit is publicly available.

A cross-site scripting vulnerability was found in Devs Palace ERP Online up to version 4.0.0 in the /inventory/sales_save file. Remote attack is possible. Exploit is publicly available. The vendor did not respond.

A cross-site scripting vulnerability was identified in Devs Palace ERP Online up to version 4.0.0 in the file /inventory/purchase_save. The attack can be initiated remotely and the exploit is publicly available.

A vulnerability was found in Canias ERP 8.03 in the doAction function of the Login RMI Interface component. Manipulation results in observable response discrepancy, allowing remote attack with high complexity. The exploit has been made public.

In libexpat before version 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

In Dotouch XproUPF version 2.0.0-release-088aa7c4, the function vlib_worker_loop in the library /usr/xpro/upf/tools/libs/libvlib.so (UPF Process component) can be manipulated, leading to denial of service.

A cross-site scripting vulnerability was found in Devs Palace ERP Online up to version 4.0.0 in the file /inventory/item-save. The attack can be carried out remotely and the exploit is publicly available.

A cross-site scripting vulnerability was detected in Devs Palace ERP Online up to version 4.0.0 in the file /inventory/customer-save. The attack can be executed remotely and the exploit is publicly available.

In Devs Palace ERP Online up to version 4.0.0, an unknown function in the file /inventory/supplier-save is vulnerable to Cross Site Scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

Devs Palace ERP Online up to version 4.0.0 is vulnerable to Cross-Site Scripting (XSS) in an unknown function of the file /inventory/purchase_return_save. The attack can be launched remotely and the exploit is public.

Vulnerability in GrapheneOS before 2026050400. Attackers can discover the real IP address of a VPN user due to a registerQuicConnectionClosePayload optimization, when 'Block connections without VPN' and 'Always-on VPN' settings are enabled. An application can let system_server transmit UDP traffic on its behalf.

JeecgBoot 3.9.1 has an authorization bypass vulnerability in the mLogin endpoint. The attack can be carried out remotely but is considered difficult to exploit.

In SysReptor before version 2026.29, users with "User Admin" permissions can change email addresses of "Superuser" users. If "Forgot Password" is enabled, they can reset the superuser's password and access the Django backend and manipulate settings.

FastGPT before version 4.14.17 has an unauthenticated SSRF vulnerability. The fetchData function does not validate URLs against an internal blocklist, allowing requests to internal/private addresses.