CVE Vulnerability Catalog

A cross-site scripting flaw was discovered in Yifang CMS up to version 2.0.5 in the store function of plugins/yifang_backend_account/logic/admin/L_rbac_admin.php within the Extended Management Module component. Manipulating the Account argument results in script injection. The attack can be executed remotely and a public exploit is available.

When sed is invoked with both -i (in-place edit) and --follow-symlinks, open_next_file() performs two separate, non-atomic filesystem operations on the same path: it resolves the symlink to its target and stores the resolved path, then opens the original symlink path for reading. A race window exists between these calls; if an attacker atomically replaces the symlink with a different target, sed reads content from the new target and writes the processed result to the previously recorded path. This can lead to arbitrary file overwrite with attacker-controlled content. The issue was fixed in version 4.10.

A Cross-Site Scripting (XSS) vulnerability was identified in BichitroGan ISP Billing Software 2025.3.20 in the Pool List Interface (/?_route=pool/add). Input manipulation enables remote attack, and a public exploit is available. The vendor did not respond to the disclosure.

A Cross-Site Scripting (XSS) vulnerability was discovered in BichitroGan ISP Billing Software 2025.3.20 in the Profile Page Handler (/?_route=settings/users-view/). Input manipulation enables remote attack. The vendor did not respond to the disclosure.

A Cross-Site Scripting (XSS) vulnerability was identified in BichitroGan ISP Billing Software 2025.3.20 in the Customer Handler (/?_route=customers/edit/). Input manipulation leads to remote attack, and a public exploit is available. The vendor did not respond to the disclosure.

A Cross-Site Scripting (XSS) vulnerability was found in langgenius dify up to 1.13.3 in the openInNewTab function of web/app/components/base/image-uploader/image-preview.tsx (ImagePreview component). Manipulating the filename argument enables remote attack, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

A vulnerability was found in liangliangyy DjangoBlog up to version 2.1.0.0 involving a hard-coded cryptographic key in djangoblog/settings.py within the File Upload Endpoint component. Manipulating the SECRET_KEY argument results in use of a hard-coded key. Remote exploitation is possible but rated as high complexity and difficult exploitability.

The Email Encoder WordPress plugin before 2.3.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0 in an unknown function of the djangoblog/settings.py file, related to settings handling. Manipulation of the USER/PASSWORD arguments leads to hard-coded credentials. The attack can be launched remotely but requires a high level of complexity. The exploit has been publicly disclosed, and the vendor did not respond.

A flaw was found in langflow-ai langflow up to 1.8.3 affecting the Frontend React Component Rendering (edit-message.tsx). Manipulation can lead to cross-site scripting, exploitable remotely, and a public exploit is available.

A security flaw was discovered in kodcloud KodExplorer up to 4.52. The initInstall function in /app/controller/systemMember.class.php, when manipulating the path argument, leads to authorization bypass. The attack may be initiated remotely and the exploit has been publicly released.

Secrets in Variables saved as JSON dictionaries were not properly redacted — when these variables were retrieved by the user, secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise, upgrade to Apache Airflow 3.2.0, which has the fix implemented.

libgphoto2 up to and including 2.5.33 has an out-of-bounds read in ptp_unpack_EOS_FocusInfoEx that could crash the library when processing input from untrusted USB devices. Commit c385b34af260595dfbb5f9329526be5158985987 contains a patch.

libgphoto2 versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c. When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation, leaking the array and its strings on every property descriptor parse.

libgphoto2 up to and including 2.5.33 has a missing null terminator in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating it; if the source is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in subsequent string operations. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue.

Stirling-PDF versions prior to 2.0.0 render user-supplied filenames directly into HTML using unsafe methods like innerHTML without sanitization. An attacker can craft a file with a malicious filename containing JavaScript that executes in the uploading user's browser context, resulting in reflected XSS across numerous upload endpoints.

A flaw has been found in lukevella rallly up to 4.7.4. It affects an unknown function in apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx within the Reset Password Handler component. Manipulation of the redirectTo argument can lead to cross site scripting, and the attack can be executed remotely.

In Note Mark versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only for existing usernames, returning immediately for nonexistent ones. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames. The issue is fixed in version 0.19.2.

The vulnerability in libexpat before version 2.8.0 is due to insufficient entropy, allowing a hash flooding attack via a crafted XML document.

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Malicious ANSI escape codes embedded in PDF metadata are passed unsanitized to terminal output when running mutool info.