CVE Vulnerability Catalog

A security vulnerability has been detected in MaxSite CMS up to 109.3. Some unknown functionality of the mail_send Plugin component is affected. Manipulation of the f_subject/f_files/f_from argument leads to cross site scripting, the attack can be initiated remotely, and the exploit has been disclosed publicly. The vendor classifies it as "Self-XSS" and recommends upgrading to 109.4.

A vulnerability was detected in MaxSite CMS up to 109.3 in the Redirect Plugin. Manipulation of the f_all/f_all404 arguments leads to cross-site scripting (XSS), and the attack can be launched remotely. The exploit is publicly available, and the vendor classifies it as Self-XSS and fixed it in version 109.4.

A weakness was identified in MaxSite CMS up to 109.3 in an unknown functionality of the /admin/plugin_antispam file of the Antispam Plugin. Manipulation of the f_logging_file argument can lead to cross-site scripting (XSS), and the attack can be launched remotely. The exploit is publicly available, and the vendor classifies it as Self-XSS and fixed it in version 109.4.

A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709. It affects an unknown part of the Ethernet Configuration Page component. Manipulation of the Name argument results in cross site scripting, and the attack can be initiated remotely.

A vulnerability has been found in Datacom DM4100 1.3.6.1.4.1.3709. It affects some unknown functionality of the VLAN Page component. Manipulation of the VLAN Name argument leads to cross site scripting, and the attack may be performed from remote.

A flaw was found in BIVOCOM TR321 21.1.1.50 in an unknown functionality of the Wireless Setting component. Manipulation of the Network Name SSID argument leads to cross-site scripting (XSS), and the attack can be carried out remotely. The exploit is publicly available.

A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. It affects an unknown function of the New RMON Statistics Page component. Manipulation of the Owner argument results in cross site scripting, and the attack can be executed remotely.

A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. It impacts an unknown function of the New RMON History Page component. Manipulation of the Owner argument leads to cross site scripting, and remote exploitation is possible.

A cross-site scripting weakness was identified in BDCOM P3310D (version 0.4.2 10.1.0F Build 86345) affecting an unknown function of the rmon event Tab component. Manipulating the Description argument can lead to script injection. The attack can be launched remotely and a public exploit is available.

A cross-site scripting flaw was discovered in BDCOM P3310D (version 0.4.2 10.1.0F Build 86345) in an unknown function of /index.asp within the New User Page component. Manipulating the User name argument results in script injection. The attack can be initiated remotely and a public exploit is available.

A cross-site scripting vulnerability was found in projeto-siga siga version 11.0.3.18 in an unknown function of /sigawf/app/responsavel/novo. Manipulating the Nome/Descrição argument results in script injection. The attack can be initiated remotely and a public exploit is available.

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. The mg_aes_gcm_decrypt function in /src/tls_aes128.c, within the GCM Authentication Tag Handler component, is affected. Manipulation leads to improper verification of a cryptographic signature, the attack may be performed remotely, and it has a high complexity level with difficult exploitability. The exploit has been publicly disclosed.

In langchain-openai, the _url_to_size() helper validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window where a hostname could resolve to a public IP during validation and to a private/localhost IP during the actual fetch. The issue affects versions prior to 1.1.14.

@astrojs/cloudflare prior to 13.1.10 uses the default redirect: 'follow' behavior when fetching remote images, allowing the Cloudflare Worker to follow HTTP redirects to arbitrary URLs. This bypasses the isRemoteAllowed() domain allowlist check, which only validates the initial URL. The vulnerability stems from an incomplete fix for CVE-2025-58179 and is fixed in 13.1.10.

AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. An authenticated attacker can replace the value of the text field in the HTTP POST request, and improper parameter validation by the server results in arbitrary JavaScript execution in the victim's browser. Critically, this may allow the attacker to obtain the administrator authentication token and perform arbitrary actions with administrative privileges, which could lead to further compromise. This issue occurs in versions released before December 2025.

libsoup contains a request smuggling vulnerability in its HTTP/1 header parsing logic. The soup_message_headers_append_common() function unconditionally appends header values without validating duplicate or conflicting Content-Length fields. This allows sending requests with multiple Content-Length headers of differing values.

A vulnerability in the uuid library before version 14.0.0 allows unexpected writes to external output buffers when generating UUID versions 3, 5, or 6. UUID version 4, which is very commonly used, is unaffected by this issue.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 is vulnerable to a security misconfiguration in the user access control panel. Improper configuration may weaken access control mechanisms.

In nimiq-transaction prior to version 1.3.0, HistoryTreeProof::verify panics on a malformed proof where history.len() != positions.len() due to assert_eq!. The proof object is derived from untrusted p2p responses (ResponseTransactionsProof.proof) and is attacker-controlled. A malicious peer could trigger a crash by returning a crafted inclusion proof.

A logic error in the cut utility of uutils coreutils causes it to ignore the -s (only-delimited) flag when -z (null-terminated) and -d '' (empty delimiter) are used together. The implementation routes this combination through a specialized newline-delimiter code path that fails to check record suppression, so cut emits the entire record plus a NUL byte instead of suppressing it.