CVE Vulnerability Catalog

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to credential leakage, which could allow an attacker to access other computers or applications.

ClipBucket V5 version 5.5.2 - #140 and earlier contains a blind SQL injection vulnerability in the /admin_area/login_as_user.php file in the Admin Area. Exploitation requires access privileges to the Admin Area.

In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g., admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user's browser. This vulnerability is fixed in 2.3.8.

Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) because unsanitized user input is processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions evaluated by the backend, potentially leading to Remote Code Execution (RCE). The vulnerability is fixed in 2.3.8.

In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g., admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user's browser. This vulnerability is fixed in 2.3.8.

In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin's browser or another user viewing the customer data, enabling session theft or admin-level actions. This vulnerability is fixed in 2.3.8.

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.

D-Link Nuclias Connect firmware versions up to 1.3.1.4 contain an observable response discrepancy vulnerability. The 'Login' endpoint returns distinct JSON responses depending on whether the username exists. An unauthenticated remote attacker can enumerate valid usernames.

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript executed in the context of other users viewing the profile entry.

A vulnerability was found in Apeman ID71 218.53.203.117. An unknown function of the file /onvif/device_service in the ONVIF Service component allows manipulation resulting in missing authentication. The attack is possible remotely and the exploit has been made public.

MQTTX is an MQTT 5.0 desktop client and MQTT testing tool. A Cross-Site Scripting (XSS) vulnerability was introduced in MQTTX v1.12.0 due to improper handling of MQTT message payload rendering. Malicious payloads containing HTML or JavaScript could be rendered directly in the MQTTX message viewer. If exploited, this could allow attackers to execute arbitrary scripts in the context of the application UI — for example, attempting to access MQTT connection credentials or trigger unintended actions through script injection. This vulnerability is especially relevant when MQTTX is used with brokers in untrusted or multi-tenant environments, where message content cannot be fully controlled. This vulnerability is fixed in 1.12.1.

LibreNMS <= 25.8.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Transports management functionality. The Transport name field value is stored and later rendered in the Transports column of the Alert Rules page without proper input validation or output encoding, leading to arbitrary JavaScript execution in the admin's browser. This vulnerability is fixed in 25.10.0.

Frappe versions prior to 14.98.0 and 15.83.0 allow an open redirect through the redirect argument on the login page if a specific type of URL is passed. The vulnerability is fixed in versions 14.98.0 and 15.83.0.

PrestaShop Checkout versions prior to 4.4.1 and 5.0.5 lack input validation in the backoffice, resulting in directory traversal and arbitrary file disclosure. Fixed in versions 4.4.1 and 5.0.5.

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not be permitted to. A fix is included in versions 2.15.1, 2.14.7, and 2.13.13.

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. Any API user with access to an API endpoint that allows specifying a filter expression can crash the Icinga 2 daemon.

Icinga 2 versions 2.4 through 2.15.0 allow authenticated API users to access variables and objects that should be hidden, including global variables and objects not permitted by permissions. Fixed in 2.15.1, 2.14.7, and 2.13.13.

The file mexcel.php in Vfront 0.99.52 contains a vulnerability due to insecure deserialization of user-controlled input. The unserialize function is called on base64-decoded $_POST['mexcel'] data without validation or the allowed_classes option, allowing an attacker to inject arbitrary PHP objects. This can lead to remote code execution, SQL injection, path traversal, or denial of service.

Hardcoded credentials were found in the ATLAS-EPIC source code in commit f29312c (2025-05-26). This means authentication data is directly embedded in the repository, readable by anyone with code access.

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected XSS vulnerability in index.php, allowing an unauthenticated attacker to execute arbitrary script in the victim's browser. The vendor declined to fix it and recommends not exposing port 8080 to the internet.