CVE Vulnerability Catalog

In Shenzhen Ruiming Technology Streamax Crocus 1.3.40, the uploadFile function in /FileDir.do?Action=Upload is vulnerable to unrestricted file upload via manipulation of the File argument. The attack can be carried out remotely, and the exploit has been released to the public.

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

ClipBucket v5 through build 5.5.2 #145 allows stored cross-site scripting (XSS) in multiple video and photo metadata fields. For videos, the Tags field and the Genre, Actors, Producer, Executive Producer, and Director fields in Movieinfos accept user-supplied values without adequate sanitization. For photos, the Photo Title and Photo Tags fields accept user-supplied values without adequate sanitization. A regular user who can edit a video or photo can inject script (for example by supplying a value such as a closing delimiter followed by a script element). The injected script executes when any user, including an unauthenticated visitor or an administrator, views the affected video or photo page. Version 5.5.2 build #146 and later contain a fix.

ClipBucket version 5.5.2 - #146 and earlier is vulnerable to path traversal in /admin_area/template_editor.php. Inadequate validation allows authenticated administrators to read and write arbitrary files outside the template directory. Fixed in version 5.5.2 - #147.

In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improper file upload validation and authentication bypass. The StaticResourceApi interface defines a route upload/{fileId} that uses a URL path parameter where both the filename and extension of uploaded files are controllable by users. During permission validation, the TokenFilter invokes the WhitelistUtils#match method to determine if the URL path is in the allowlist; if the requestURI ends with .js or similar extensions, it is directly deemed safe and bypasses permission checks, allowing an attacker to access "upload/1.js" while specifying arbitrary file extensions, enabling the upload of HTML files containing malicious JavaScript.

ImageMagick versions prior to 7.1.2-7 and 6.9.13-32 contain an integer overflow in the BMP decoder on 32-bit systems. When calculating the extent value (columns × bits per pixel), the multiplication can overflow and wrap to zero, and the overflow check added for CVE-2025-57803 is placed after the overflow occurs. Only 32-bit builds with manually increased resource limits are affected; 64-bit systems and default limits are not vulnerable. Fixed in 7.1.2-7 and 6.9.13-32.

A vulnerability in yanyutao0402 ChanCMS up to 3.3.2 affects the getArticle function in app\modules\cms\controller\gather.js. The manipulation results in code injection. The attack can be launched remotely and the exploit is public.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allows Stored XSS.This issue affects Memberlite Shortcodes: from n/a through 1.4.1.

A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.2. The hasUse function in the file /cms/model/hasUse is vulnerable to SQL injection via manipulation of the ID argument. The attack may be initiated remotely and the exploit has been disclosed publicly.

A flaw has been found in yanyutao0402 ChanCMS up to 3.3.2. The update function in the file /cms/article/update is vulnerable to SQL injection via manipulation of the cid argument. The attack can be launched remotely and the exploit has been published.

A vulnerability was detected in yanyutao0402 ChanCMS up to 3.3.2. The findField function in the file /cms/article/findField is vulnerable to SQL injection via manipulation of the cid argument. The attack can be initiated remotely and the exploit is now public.

The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmp_user_payout_detail_of_current_user() function selecting payout records solely by id without verifying ownership. This makes it possible for authenticated attackers with the bmp_user role (often subscribers) to view other members' payout summaries via direct requests to the /bmp-account-detail/ endpoint with a crafted payout-id parameter granted they can access the shortcode output.

In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out-of-bounds read issue in _ux_host_class_audio_alternate_setting_locate() when parsing a descriptor with attacker-controlled frequency fields.

In USBX (USB support module for Eclipse Foundation ThreadX) before version 6.4.3, a potential out-of-bounds read exists in _ux_host_class_audio_device_type_get() when parsing a USB audio device descriptor.

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_streaming_sampling_get() when parsing a descriptor of an USB streaming device.

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there is a potential out-of-bounds read issue in _ux_host_class_hid_report_descriptor_get() when parsing a descriptor of a USB HID device.

In NetX Duo before version 6.4.4, the networking module for Eclipse Foundation ThreadX, there is a potential out-of-bounds read issue in _nx_ipv4_packet_receive() when handling unicast DHCP messages, which could cause corruption of 4 bytes of memory.

In Eclipse Foundation NetX Duo before version 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out-of-bounds read issue in _nx_ipv4_option_process() when processing an IPv4 packet with the timestamp option.

Moxa network security appliances and routers contain an Execution with Unnecessary Privileges vulnerability. A flaw in API authorization logic allows an authenticated low-privileged user to execute the administrative ping function, enabling internal network reconnaissance.

Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script in the response phase rewrites a response body so that its size exceeds the configured per_connection_buffer_limit_bytes, Envoy generates a local reply whose headers override the original response headers, leaving dangling references and causing a crash.