CVE Vulnerability Catalog

The Eaton UPS Companion software installer has a vulnerability related to improper quotation in search paths, which could lead to arbitrary code execution by an attacker with access to the file system. This issue has been fixed in the latest version of EUC.

Nozomi Networks Labs discovered that validation of incoming XML messages is inadequate, which could allow an attacker to perform XSS on the user's browser. The manufacturer has released a patch; refer to the manufacturer's report for details.

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

Cybersecurity Nozomi Networks Labs has discovered inadequate permission management for camera guest account. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.

In Gitea before 1.21.2, an anonymous user can visit a private user's project. This flaw violates privacy and may lead to unauthorized access to information.

Gitea before version 1.22.2 mishandles the propagation of token scope for access control within one of its own package registries.

Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order. This flaw may allow tracking of user activity.

Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.

Gitea before version 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.

A vulnerability was determined in YunaiV yudao-cloud up to 2025.11 affecting the BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger functions of the Business Process Management component. Manipulation of the url/header/body arguments can lead to server-side request forgery. The attack may be performed remotely and the exploit has been publicly disclosed.

Gitea before 1.25.2 mishandles authorization for deletion of releases. This flaw may allow unauthorized users to delete releases.

A vulnerability was discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414 involving cross-site scripting in the userLogin function in the file src/main/java/com/flycms/web/front/UserController.java. Manipulation of the redirectUrl argument allows remote attack execution. The exploit is publicly available and may be used.

A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected element is an unknown function of the file src/main/java/com/flycms/web/system/IndexAdminController.java of the component Admin Login. Performing a manipulation of the argument redirectUrl results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

The Frontend Post Submission Manager Lite (Frontend Posting) WordPress plugin up to and including version 1.2.6 is vulnerable to unauthorized loss of data due to an incorrect authorization check in the 'media_delete_action' function. This allows unauthenticated attackers to delete arbitrary attachments.

A vulnerability was detected in JEPaaS up to 7.2.8 in the postilService.loadPostils function of /je/postil/postil/loadPostil. Manipulation of the keyWord argument results in SQL injection, and remote exploitation is possible. The exploit is now public and may be used.

A security vulnerability has been detected in youlai-mall 1.0.0/2.0.0 in the submitOrderPayment function of OrderController.java. Manipulation of the orderSn argument leads to improper authorization, and the attack may be launched remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile in the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. The manipulation causes improper access controls. The attack may be initiated remotely, and the exploit has been made available to the public.

ONLYOFFICE Docs before version 9.2.1 contains an XSS vulnerability related to the Color theme name, which may allow injection of malicious script.

XSS vulnerability in ONLYOFFICE Docs before 9.2.1, present in the Font field of the Multilevel list settings window. This is related to DocumentServer.

A security flaw has been discovered in youlai-mall versions 1.0.0 and 2.0.0 affecting the deductBalance function in MemberController.java. The manipulation results in improper authorization and can be launched remotely. The exploit has been released to the public and may be exploited.