CVE Vulnerability Catalog

Open Source Point of Sale prior to version 3.4.3 has a stored XSS vulnerability in the Daily Sales management table. The customer_name column is rendered as raw HTML, allowing an attacker with customer management permissions to inject JavaScript via first_name or last_name fields.

Stored XSS vulnerability in the Cargo extension for MediaWiki. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code that executes whenever the page is viewed.

XSS vulnerability in the Cargo extension for MediaWiki, targeting non-script elements. Improper input neutralization during page generation allows injection of malicious code.

The Cargo extension for MediaWiki before version 3.8.7 is vulnerable to stored XSS due to improper neutralization of script-related HTML tags. Attackers can inject malicious scripts that execute when a page is viewed.

The ProofreadPage extension for MediaWiki is vulnerable to Cross-Site Scripting (XSS) targeting non-script elements. The issue is fixed in the master branch and in MediaWiki versions 1.43, 1.44, and 1.45.

The Cargo extension for MediaWiki is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of script-related HTML tags.

Cosign, a tool for signing containers and binaries, erroneously reports 'Verified OK' for attestations with malformed payloads or mismatched predicate types. The flaw exists in versions before 3.0.6 and 2.6.3.

Parse Server is vulnerable to disclosure of protected session fields via the GET /sessions/me endpoint. This endpoint returns _Session fields that the server operator configured as protected, while other endpoints correctly strip them.

Stored XSS vulnerability in Open Source Point of Sale before version 3.4.3. Insufficient input sanitization in the stock_location parameter allows injection of malicious JavaScript that executes in the Employees interface.

Plane, an open-source project management tool, has a vulnerability in the IssueBulkUpdateDateEndpoint that allows a project member to modify start_date and target_date of any issue across the entire instance, regardless of workspace or project membership. This affects versions prior to 1.3.0.

JWCrypto before 1.5.7 does not validate decompressed output size in JWE tokens with ZIP compression. An attacker can send a small token (under 250KB) that decompresses to about 100MB, causing server memory exhaustion.

WWBN AVideo, an open-source video platform, has a Server-Side Request Forgery (SSRF) vulnerability in the Live restream log callback flow. An authenticated streamer can store an arbitrary callback URL that is later fetched server-side. This affects versions 26.0 and prior.

AVideo is an open source video platform where the EPG feature parses XML from user-controlled URLs and renders programme titles directly into HTML without sanitization. A user with upload permission can set a malicious XML file with JavaScript in <title> elements. This affects versions 26.0 and prior.

WWBN AVideo versions 26.0 and prior have a vulnerability in the PayPal IPN v1 handler that lacks transaction deduplication. An attacker can replay a single IPN notification to repeatedly inflate wallet balance and renew subscriptions.

Vite, a frontend tooling framework for JavaScript, versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, has a vulnerability in handling .map requests for optimized dependencies. The dev server resolves file paths and calls readFile without restricting ../ segments in the URL, allowing bypass of the server.fs.strict allow list and retrieval of .map files outside the project root if they can be parsed as valid source map JSON.

Semtech LR11xx LoRa transceivers with early firmware versions have an information disclosure vulnerability in firmware validation. After a firmware validity check command via SPI, the last decrypted block remains in memory, allowing an attacker with SPI access to read the decrypted firmware.

Semtech LoRa LR11xxx transceivers with early firmware versions have improper access control allowing stack memory writes via the SPI interface. An attacker with physical access can hijack program flow and execute arbitrary code, but changes are lost on reboot.

The ReportIncident extension in Wikimedia Foundation MediaWiki has an allocation of resources without limits vulnerability, allowing HTTP DoS attacks. The fix is only available on the master branch.

RustFS is a distributed object storage system where prior to alpha.90, there is a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can copy victim objects into an attacker-controlled multipart upload and complete the upload.

Scoold, a Q&A and knowledge sharing platform for teams, has an authorization flaw that allows any logged-in, low-privilege user to overwrite another user's existing question by supplying its public ID as the postId parameter. This affects versions prior to 1.66.2.