CVE Vulnerability Catalog

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application's recruitment attachment retrieval endpoint does not enforce the required authorization checks before serving candidate files. Even users restricted to ESS-level access, who have no permission to view the Recruitment module, can directly access candidate attachment URLs. As a result, any authenticated user can download CVs and other uploaded documents for arbitrary candidates, leading to unauthorized exposure of sensitive applicant data. This issue has been patched in version 5.8.

Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the victim's browser via a crafted URL to the passQueryParameters function with the xml parameter enabled.

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. Fields such as username and description are rendered directly into HTML without proper sanitization or encoding, allowing attackers to inject and execute malicious scripts.

Werkzeug, a comprehensive WSGI web application library, prior to version 3.1.4 allows path segments with Windows device names (e.g., CON, AUX) in its safe_join function. On Windows, a request for a path ending with such a name opens the file but reading hangs indefinitely. The issue is patched in version 3.1.4.

In OpenPrinting CUPS before version 2.4.15, a user in the lpadmin group can use the web UI to change the config and insert a malicious line. The cupsd process running as root parses the new config, causing an out-of-bounds write.

OpenPrinting CUPS before version 2.4.15 is vulnerable to a slowloris-style attack. A client sending very slow messages (e.g. one byte per second) blocks cupsd, preventing other clients from being served.

Kiteworks prior to version 9.1.0 has improper input validation when managing roles of a shared folder. This could lead to unexpectedly elevating another user's permissions on the share. The issue has been patched in version 9.1.0.

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0.

Kiteworks MFT prior to version 9.1.0 allows an external attacker to gain access to system log information by tricking an administrator into browsing a crafted fake page. The issue is patched in version 9.1.0.

Retro is an online platform providing items of vintage collections. Prior to version 2.4.7, Retro is vulnerable to a cross-site scripting (XSS) in the input handling component. This issue has been patched in version 2.4.7.

fontTools versions from 4.33.0 to before 4.60.2 have an arbitrary file write vulnerability in the varLib script that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib.

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users' personal information. This issue has been patched in version 4.5.6.

ClipBucket v5 prior to version 5.5.2 - #164 contains an authorization bypass vulnerability in the AJAX flagging system that allows any unauthenticated user to flag any content (users, videos, photos, collections). This can lead to mass flagging attacks, content disruption, and moderation system abuse.

In Cilium prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicies using egress.toGroups.aws.securityGroupsIds referencing non-existent or unattached AWS security groups may unintentionally allow broader outbound access than intended. The toCIDRset section of the derived policy is not generated, permitting traffic to more destinations.

Exposure of credentials in unintended requests in Devolutions Server and Remote Desktop Manager on Windows. This issue affects Devolutions Server through 2025.3.8.0 and Remote Desktop Manager through 2025.3.23.0.

A vulnerability in Apache Kvrocks reveals plaintext credentials in the MONITOR command. This issue affects Apache Kvrocks from 1.0.0 through 2.13.0.

Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.

A file upload vulnerability exists in HCL Technologies Ltd. Unica 12.0.0. The description does not specify the mechanism but concerns the upload functionality.

HCL Technologies Unica 12.0.0 contains a Cross-site Scripting (XSS) vulnerability. It may allow execution of malicious script in the context of a user's browser.

A Cross-Site Request Forgery (CSRF) vulnerability exists in HCL Technologies Ltd. Unica 12.0.0. The description does not specify the mechanism details.