CVE Vulnerability Catalog

A reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3 allows an unauthenticated remote attacker to execute JavaScript in the victim's browser context.

In the Linux kernel sched_ext subsystem, a possible deadlock exists in deferred_irq_workfn() on PREEMPT_RT=y kernels. When the function runs in the per-CPU irq_work/* task context without interrupts disabled, an interrupt may re-acquire the same rq->__lock. The fix forces the function to always run in hard-irq context.

Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sanitization in the login form, incorrect login attempts in logs are triggered as XSS in the admin panel.

Centreon Infra Monitoring versions 24.10.0 before 24.10.5, 24.04.0 before 24.04.5, and 23.10.0 before 23.10.4 are vulnerable to Stored Cross-Site Scripting in the Notification rules and Open tickets module. The vulnerability is due to improper neutralization of input during web page generation and can be exploited by users with elevated privileges.

Centreon Infra Monitoring (Hostgroup configuration page) is vulnerable to Stored XSS due to improper neutralization of input during web page generation, exploitable by users with elevated privileges.

The WordPress plugin Custom 404 Pro (custom-404-pro) in versions up to and including 3.12.0 contains a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability allows unauthorized actions to be performed in the context of a logged-in user.

The Feather Login Page plugin for WordPress (versions up to and including 1.1.7) is vulnerable to Cross-Site Request Forgery (CSRF). Missing protections allow an attacker to trick a logged-in user into performing unwanted actions.

The Void Elementor WHMCS Elements For Elementor Page Builder plugin is vulnerable to Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.0.1.2.

An authenticated local user can obtain information that allows claiming security policy rules of another user because sensitive information is printed in plaintext in Identity Agent for Terminal Services debug files.

An authenticated local user can obtain information that allows claiming security policy rules of another user because sensitive information is accessible in the Windows Registry keys for Check Point Identity Agent running on a Terminal Server.

A security flaw has been discovered in loganhong php loganSite up to c035fb5c3edd0b2a5e32fd4051cbbc9e61a31426. This affects an unknown function of the file /includes/article_detail.php of the Article Handler component. Manipulation of the ID argument results in SQL injection, and the attack can be initiated remotely. The product uses a rolling release model, so no version details are available.

A stack-based buffer overflow vulnerability was identified in the sokol library (sokol_gfx.h) in the _sg_validate_pipeline_desc function. The attack must be carried out locally, and the exploit is publicly available. The product uses a rolling release model, so version information is not disclosed; a patch named b95c5245ba357967220c9a860c7578a7487937b0 is available.

Delta Electronics DVP15MC11T lacks proper validation of Modbus/TCP packets, which can lead to denial of service.

A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload. Manipulation of the argument File can lead to unrestricted upload, and the attack may be launched remotely.

A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. Manipulation of the argument orderby leads to SQL injection, and the attack can be initiated remotely.

A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Manipulation of the argument e_id results in SQL injection, and the attack can be carried out remotely.

The WordPress plugin TempTool [Show Current Template Info] is vulnerable to stored XSS due to improper neutralization of input during web page generation. The vulnerability affects versions from n/a through <= 1.3.1.

The WP Microdata plugin for WordPress is vulnerable to stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.0.

The HappyDevs TempTool [Show Current Template Info] plugin in versions up to and including 1.3.1 exposes sensitive system information to an unauthorized control sphere, allowing retrieval of embedded sensitive data.

The Image Photo Gallery Final Tiles Grid plugin for WordPress in versions up to and including 3.6.8 is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting due to insufficient input sanitization and output escaping. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages.