CVE Vulnerability Catalog

SourceCodester User Account Generator 1.0 contains a Cross-Site Scripting (XSS) vulnerability in the Username Prefix field. Due to improper sanitization of user-supplied input when rendering generated account data to the DOM, persistent injection of malicious HTML elements that execute when clicked by users is possible.

A cross-site scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test titles and matching pair items before rendering them in the DOM.

AstrBot Project v3.5.22 has an arbitrary file read vulnerability in the _encode_image_bs64 function. Since the function opens the image specified by the user in the request body and returns the image content as a base64-encoded string without checking the legitimacy of the image path, attackers can construct malicious URLs to read any specified file, resulting in sensitive data leakage.

A security flaw has been discovered in Campcodes School File Management 1.0. This affects an unknown part of the file /admin/update_user.php. Performing manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.

GE Vernova Smallworld on Windows and Linux is affected by a path traversal vulnerability (improper limitation of a pathname to a restricted directory) that allows file manipulation. This issue affects Smallworld 5.3.5 and previous versions.

An Open Redirect vulnerability exists in the OAuth callback handler in onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The application trusts the X-Forwarded-Host header without proper validation when constructing a redirect URL, allowing a remote attacker to redirect an authenticated user to an arbitrary external website.

A vulnerability was identified in projectworlds Online Notes Sharing Platform 1.0 in an unknown functionality of the file /dashboard/userprofile.php. Manipulation of the image argument leads to unrestricted upload. The attack may be performed remotely and the exploit is publicly available and might be used.

An issue was discovered in rymcu forest through commit f782e85 (2025-09-04) in the doBefore function in src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized attackers to delete arbitrary users' posts.

There is an arbitrary file download vulnerability in GuoMinJim PersonManage through commit 5a02b1ab208feacf3a34fc123c9381162afbaa95 (2020-11-23) in the document query function under the Download Center menu.

A cross-site scripting (XSS) vulnerability has been reported in Download Station. If a remote attacker gains a user account, they can exploit it to bypass security mechanisms or read application data.

A relative path traversal vulnerability affects Download Station. A remote attacker with an administrator account can read unexpected files or system data. The fix is available in versions 5.10.0.305 and 5.10.0.304.

A path traversal vulnerability has been reported in Qsync Central. A remote attacker with a user account can exploit it to read unexpected files or system data.

A cross-site scripting (XSS) vulnerability has been reported in File Station 5. A remote attacker with a user account can exploit it to bypass security mechanisms or read application data.

A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuLog Center 1.8.2.923 (2025/08/27) and later.

An allocation of resources without limits or throttling vulnerability affects File Station 5. A remote attacker with a user account can prevent other systems, applications, or processes from accessing the same resource. The fix is in version 5.5.6.5018.

A NULL pointer dereference vulnerability affects File Station 5. A remote attacker with a user account can exploit it to launch a denial-of-service (DoS) attack. The fix is in version 5.5.6.5018.

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. A remote attacker with an administrator account can exploit it to prevent other systems, applications, or processes from accessing the same type of resource.

An allocation of resources without limits or throttling vulnerability in File Station 5 allows a remote attacker with a user account to exhaust resources. This can prevent other systems, applications, or processes from accessing the same type of resource.

An allocation of resources without limits or throttling vulnerability in File Station 5 allows a remote attacker with a user account to exhaust resources. This can prevent other systems, applications, or processes from accessing the same type of resource.