CVE Vulnerability Catalog

Vulnerability in Oracle Financial Services Revenue Management and Billing (component: Security Management System) affecting versions 2.9.0.0.0–7.2.0.0.0. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data or all data accessible in the application.

Vulnerability in Oracle Financial Services Revenue Management and Billing (component: Security Management System) in versions 2.9.0.0.0–7.2.0.0.0. Allows a high-privileged attacker with network access via HTTP to gain unauthorized access to critical data. CVSS 3.1 Base Score 4.9.

Liferay Portal (versions 7.4.0 through 7.4.3.132) and Liferay DXP (specific versions) are vulnerable to reflected XSS in the google_gadget parameter. A remote, unauthenticated attacker can inject JavaScript.

code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.

OpenText Flipper version 3.1.2 contains a path traversal vulnerability due to external control of file name or path. This could allow a user to access files hosted on the server.

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.

The vulnerability stems from HTTP security misconfiguration — cookies lack Secure and HTTPOnly attributes. This allows reading sensitive cookies from the JavaScript context, e.g., via XSS. It affects BLU-IC2 and BLU-IC4 devices up to version 1.19.5.

Zimbra Collaboration (ZCS) before version 10.1.12 is vulnerable to SSRF due to the chat proxy configuration.

Mastodon version 4.4 added support for verifiable quote posts with quote controls, but in versions prior to 4.4.8 and 4.5.0-beta.2 an attacker can bypass these controls. Since reblogs are internally treated as statuses, an attacker could reblog any post, then quote their reblog, technically quoting themselves but having the quote feature preview a post they were not authorized for. The issue is patched in versions 4.4.8 and 4.5.0-beta.2.

WeGIA, an open source web manager for institutions, has a reflected XSS vulnerability in the editar_info_pessoal.php endpoint prior to version 3.5.1. Attackers can inject malicious scripts in the action parameter.

WeGIA, an open source Web Manager for Institutions, prior to version 3.5.1, contains a reflected cross-site scripting (XSS) vulnerability in the editar_info_pessoal.php endpoint. This vulnerability allows attackers to inject malicious scripts in the sql parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?sql=1. This issue has been patched in version 3.5.1.

Koa, a framework for Node.js, in versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, has a bypass to CVE-2025-8129 affecting its back redirect functionality. An attacker can manipulate the Referer header to force a user's browser to navigate to an external, potentially malicious website.

The Moodle OpenAI Chat Block plugin version 3.0.1 (2025021700) suffers from an IDOR vulnerability due to insufficient validation of the blockId parameter in /blocks/openai_chat/api/completion.php. An authenticated student can impersonate another user's block (e.g., administrator) and send queries executed with that block's configuration.

Improper Authentication in Liferay Portal and Liferay DXP allows remote attackers to send malicious data that is treated as trusted via unauthenticated cluster messages.

Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Employee Notes, title, or description parameters. The patched version is PP-Release-6.3.2.0.

Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.

Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.

Podatność CVE-2025-10612 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w City Guide od giSoft Information Technologies, co pozwala na ataki typu Reflected XSS. Problem ten występuje w wersjach przed 1.4.45.

SolarWinds Observability Self-Hosted is susceptible to SQL injection that may display sensitive data using a low-level account. Requires authentication from a low-privilege account.

The PageTriage extension in MediaWiki contains a Stored XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions from master before 1.44.