CVE Vulnerability Catalog

The Media Library Assistant plugin (up to and including 3.34) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This can lead to execution of malicious script in a user's browser.

Pi-hole Admin Interface from 6.0 to before 6.5 places configuration values from the /api/config endpoint directly into HTML value="" attributes without escaping in settings-advanced.js, enabling HTML attribute injection. A double quote in any config value breaks out of the attribute context. JavaScript execution is blocked by the server's CSP (script-src 'self'), but injected attributes can alter element styling for UI redressing. The primary attack vector is importing a malicious teleporter backup, which bypasses per-field server-side validation.

Pi-hole Admin Interface versions 6.0 to before 6.5 contain a reflected DOM-based XSS vulnerability in taillog.js. An unauthenticated attacker can inject arbitrary HTML into the admin interface via a crafted URL because the file parameter is interpolated into innerHTML without escaping. The missing form-action directive in Content-Security-Policy allows injected forms to exfiltrate credentials. The vulnerability is fixed in 6.5.

A stored cross-site scripting (XSS) vulnerability in Bynder before 12 January 2026 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

A SQL Injection vulnerability was found in itsourcecode Construction Management System 1.0 in the /borrowed_equip.php file within the Parameter Handler component. Manipulation of the emp argument allows injection of malicious SQL code. The attack can be performed remotely, and the exploit has been publicly disclosed.

pytries datrie up to 0.8.3 has a deserialization issue in Trie.load, Trie.read, and Trie.__setstate__ in src/datrie.pyx (trie File Handler). The attack can be launched remotely, the exploit is public, and the project has not responded to the issue report.

A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

A vulnerability has been found in code-projects Online Application System for Admission 1.0. This issue affects some unknown processing of the file /enrollment/admsnform.php of the component Endpoint. Such manipulation leads to SQL injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

libtheora contains a heap-based out-of-bounds read vulnerability in the AVI parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk.

A SQL injection vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1 within the file /admin/update-image1.php. Manipulation of the filename argument results in SQL injection. The attack may be performed remotely, and the exploit has been made public.

A SQL Injection vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1 in the /admin/update-image2.php file within the Parameter Handler component. Manipulation of the filename argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in PHPGurukul Online Shopping Portal Project version 2.1. An unknown function in /admin/update-image3.php is impacted, where manipulation of the filename argument can lead to SQL injection. The attack can be executed remotely, and a public exploit is available.

A path traversal vulnerability was detected in HerikLyma CPPWebFramework up to version 3.1 in some unknown processing. Remote exploitation is possible and a public exploit is available.

SQL Injection vulnerability in PHPGurukul Online Shopping Portal Project 2.1. Unknown part of /cancelorder.php in Parameter Handler allows manipulation of oid argument, leading to SQL injection. Remote attack possible. Exploit published.

SQL Injection vulnerability in PHPGurukul Online Shopping Portal Project 2.1. Unknown functionality in /categorywise-products.php in Parameter Handler allows manipulation of cid argument, leading to SQL injection. Remote attack possible. Exploit published.

Fix in the Linux kernel for ksmbd: uses volume UUID in FS_OBJECT_ID_INFORMATION. For filesystems without UUID, falls back to stfs.f_fsid from vfs_statfs().

A cross-site scripting vulnerability has been found in assafelovic gpt-researcher up to version 3.4.3 in the Report API component in file backend/server/app.py.

gpt-researcher up to 3.4.3 has an XSS vulnerability in the WebSocket interface via the 'task' argument in researcher.php. Remote exploitation is possible and the exploit is public.

Cross-Site Request Forgery (CSRF) vulnerability in ProjectSend r2002 in upload.php. The attack can be performed remotely. An exploit is publicly available.

Huly Platform (hcengineering) version 0.7.382 has a server-side request forgery vulnerability in the Import endpoint at server/front/src/index.ts. The attack can be launched remotely, and the exploit is publicly available.