CVE Vulnerability Catalog

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request.

Rallly prior to version 4.5.4 has an insecure direct object reference (IDOR) vulnerability that allows any authenticated user to modify other participants' votes in polls without authorization. The backend relies solely on the participantId parameter without verifying ownership or poll permissions.

esm.sh prior to version 136 contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript conversion. Malicious JavaScript injected via ${...} expressions in CSS files executes when the module is imported, enabling XSS in browsers and RCE in Electron applications.

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplication endpoint (/api/trpc/polls.duplicate) allows any authenticated user to duplicate polls they do not own by modifying the pollId parameter. This effectively bypasses access control and lets unauthorized users clone private or administrative polls.

Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections.

Prior to Astro 5.15.8, a mismatch exists between how Astro normalizes request paths for routing and how middleware reads the path for validation. Astro applies decodeURI() while middleware uses context.url.pathname without normalization, potentially allowing bypass of validation checks.

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, invitations were considered valid regardless of expiration, relying on background tasks to clean up expired ones, which can take up to 5 minutes or longer with a large backlog.

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even when the account was deactivated. Other permissions are correctly applied and federation with other providers still take assigned policies correctly into account. authentik versions 2025.8.5 and 2025.10.2 fix this issue. A workaround involves adding a policy to the application that explicitly checks if the service account is still valid, and deny access if not.

eGovFrame Common Components up to version 4.3.1 has an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/insertImageCk.do endpoints. An attacker can upload arbitrary content, and the server stores the file and returns a download URL, allowing the application to be used as a file hosting service.

AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 expose an unauthenticated file upload endpoint (ajaxPromptUploadFile.php) in the F2MAdmin web component. A remote attacker can upload or overwrite files in C:\F2MAdmin\tmp without authentication or file-type validation.

An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry AtHoc (OnPrem) version 7.21 could allow an attacker to potentially gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System (IWS).

The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, a reserved internal name for Looker's internal MySQL database. The schemas parameter is vulnerable to SQL injection, enabling attackers to manipulate SELECT queries executed against the internal MySQL database, allowing users with developer permissions to extract data.

A reflected cross-site scripting (XSS) vulnerability exists in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier. Attackers can inject a crafted payload into the id parameter to execute arbitrary JavaScript in the user's browser.

Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.

A SQL injection vulnerability was identified in code-projects Courier Management System 1.0 in the file /add-office.php. Manipulation of the OfficeName argument allows SQL injection, and the attack can be performed remotely. The exploit has been made publicly available.

A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01). The sle_sSenha parameter to loginAlterarSenha.asp allows an attacker to craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser within the application's security context.

Podatność CVE-2025-11963 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w StarCities, co pozwala na ataki typu Reflected XSS. Problem ten występuje w wersjach przed 1.1.61.

Podatność CVE-2025-0421 dotyczy niewłaściwego ograniczenia renderowanych warstw interfejsu użytkownika lub ramek w oprogramowaniu Shopside firmy Shopside Software Technologies Inc. Problem ten występuje w wersji Shopside do 05022025, umożliwiając wykorzystanie nakładek iFrame.

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. This issue affects all current versions.

Fortinet FortiADC 8.0.0, 7.6.0 through 7.6.3, 7.4 all versions, and 7.2 all versions contain a basic XSS vulnerability due to improper neutralization of script-related HTML tags. An attacker may execute unauthorized code or commands via a crafted URL.