CVE Vulnerability Catalog

gpp-burgerportaal is a Dutch government citizen portal application. In versions before 2.0.3, 3.0.2, and 4.0.1, the name and email address of employees who publish content are exposed in network responses and can be discovered via browser developer tools. This issue has been patched in versions 2.0.3, 3.0.2, and 4.0.1; no known workarounds exist.

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint, specifically in the nextPage parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft.

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /pet/profile_pet.php?id_pet= endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_pet parameter. This vulnerability is fixed in 3.5.0.

WeGIA, an open source web manager for institutions, prior to version 3.5.1 has a Reflected Cross-Site Scripting (XSS) vulnerability in the log parameter in configuracao_geral.php. An attacker can inject arbitrary JavaScript, which executes in the victim's browser. This vulnerability is fixed in 3.5.1.

The Menu Display Widget in Liferay Portal and Liferay DXP shows content to users who lack permission to view it. This could expose sensitive information to unauthorized users.

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.

In text-generation-webui versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path, allowing an unauthenticated attacker to read sensitive files on the server.

An IDOR vulnerability in Liferay Portal and Liferay DXP allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.

Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a user's first, middle, or last name text field, displayed in page comments, blog entry comments, document and media comments, message board messages, wiki page comments, and other widgets/apps that support mentions. The vulnerability affects Portal 7.4.0 through 7.4.3.111 and DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92.

In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allows OAuth clients without the read scope to subscribe to public channels and receive public timeline events.

In Mastodon before versions 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API. Such accounts can continue receiving real-time updates through existing streaming connections and establish new streaming connections.

Prior to 1.1.5 and 1.0.2, a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource requests through the API endpoints.

Liferay Portal and Liferay DXP contain an IDOR vulnerability involving account addresses. A remote authenticated user can view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter.

Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users from one virtual instance to view the shipment addresses of a different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.

An insecure direct object reference (IDOR) and improper permission check vulnerability exists in Publications in Liferay Portal and Liferay DXP. A remote authenticated attacker can view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter and edit comments via crafted URLs.

Vickey, a Misskey-based microblogging platform, has a vulnerability in versions prior to 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. This may result in unintended email traffic but does not expose user data. The issue was addressed in version 2025.10.0.

An insecure direct object reference (IDOR) vulnerability exists in the Publications module of Liferay Portal 7.3.1 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 36. A remote authenticated attacker can view the edit page of a publication via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter.

SupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior contain a UNIX Symbolic Link (Symlink) following vulnerability. A low-privileged attacker with local access to the system could exploit this to delete arbitrary files only on that affected system.

A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash (BSOD).

A stack buffer overflow has been identified in the AsIO3.sys driver. The vulnerability can be triggered by input manipulation, potentially leading to a system crash (BSOD) or other undefined execution.