CVE Vulnerability Catalog

LiquidJS before version 10.25.3 has a vulnerability in the replace filter that incorrectly accounts for memory usage when the memoryLimit option is enabled. An attacker controlling template content can bypass DoS protection and cause out-of-memory conditions with approximately 2500x amplification.

Dell PowerProtect Agent Service prior to version 20.1 has incorrect permission assignment for critical resources, allowing a low-privileged local attacker to access information.

The WordPress plugin Image Photo Gallery Final Tiles Grid (versions up to 3.6.11) contains an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels.

In Electron prior to versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, a vulnerability was found in the clipboard.readImage() function. If the clipboard contains image data that fails to decode, passing a null bitmap to image construction causes a controlled abort and process crash. Only apps calling clipboard.readImage() are affected.

Plane is an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts).

OrangeHRM Open Source from version 5.0 to 5.8 encrypts sensitive fields with AES in ECB mode, preserving plaintext patterns in ciphertext and enabling pattern disclosure against stored data. Fixed in version 5.8.1.

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records.

Parse Server is an open source backend. Prior to 9.8.0-alpha.6 and 8.6.74, the login endpoint response time differs measurably depending on whether the submitted username or email exists. When a user is not found the server responds immediately, while an existing user with a wrong password triggers a bcrypt comparison adding latency. This timing difference allows an unauthenticated attacker to enumerate valid usernames.

An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 3.0 (Low). The issue was fixed in version 4.0.260206.0 of the runZero Platform.

An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 2.2 (Low). The issue was fixed in version 4.0.260205.0 of the runZero Platform.

An issue allowing MCP agents to access certificate information outside their authorized organization scope has been resolved. It is CWE-863 Incorrect Authorization with an estimated CVSS of 3.0 (Low), fixed in runZero Platform version 4.0.260203.0.

An issue in the runZero Platform that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an instance of CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, with an estimated CVSS score of 2.7 (Low). The issue was fixed in version 4.0.260203.0.

An issue was discovered in Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30 where admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data. Earlier unsupported Django series (5.0.x, 4.1.x, 3.2.x) may also be affected.

Vulnerability in Erlang/OTP DNS module (inet_res, inet_db) allows DNS cache poisoning. It uses a sequential, process-global 16-bit transaction ID without source port randomization, making it easy for an attacker to predict the ID and inject forged responses.

WWBN AVideo versions 26.0 and prior have a vulnerability in the BlockonomicsYPT plugin's check.php endpoint. The endpoint returns payment order data for any Bitcoin address without requiring authentication, allowing an attacker to query payment records for any address used on the platform.

In Meesho Online Shopping App for Android up to version 27.3, the component com.meesho.supply in the file /api/endpoint uses a risky cryptographic algorithm. The attack can be performed remotely but is difficult to exploit.

A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used.

In the Pi-hole Admin Interface, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The vulnerability is fixed in 6.5.

In the Pi-hole Admin Interface, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js and charts.js/index.js. Although upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping, inconsistent with other fields. The vulnerability is fixed in 6.5.

A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Online Shoe Store 1.0 in the Add Product Page (/admin/admin_feature.php). Manipulating the product_name argument enables remote attack, and the exploit is publicly available.