CVE Vulnerability Catalog

Cross-site scripting vulnerability in the QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript code in the page.

Cross-site scripting vulnerability in the attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.

The WP Private Content Plus plugin through version 3.6.2 provides a global content protection feature that requires a password, but the access control check is based only on the presence of an unprotected client-side cookie. An unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.

SOOP-CLM developed by PiExtract has a Server-Side Request Forgery (SSRF) vulnerability, allowing privileged remote attackers to read server files or probe internal network information.

Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain user group names.

Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain information such as account names and IP addresses.

A vulnerability in code-projects Automated Voting System 1.0. It affects an unknown functionality in /admin/update_user.php, where the Password argument causes SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.

A vulnerability was found in code-projects Automated Voting System 1.0. An unknown function of the file /admin/add_candidate_modal.php is affected. Manipulation of the firstname argument results in SQL injection. The attack can be executed remotely and the exploit has been made public.

Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sites or domains.

A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument current_force_upgrade_pwd can lead to use of hard-coded password. The attack can only be executed locally. The exploit has been published and may be used.

A vulnerability was detected in D-Link DAP-2695 2.00RC131. This affects the function fwupdater_main of the file rgbin of the component Firmware Update Handler. Performing manipulation results in os command injection. The attack may be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.

A SQL injection vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0, affecting the /admin/search-appointment.php file. Manipulation of the searchdata argument leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.

A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-services.php. Manipulation of the 'sername' argument causes SQL injection. The attack can be initiated remotely and the exploit has been made publicly available.

HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users.

HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS). An attacker can inject malicious script into an HTTP request, which is then unsafely reflected in the server's response, executing the script in the victim's browser.

A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924. The impacted element is an unknown function of the component SVG File Handler. Performing manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continuous delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Tomofun Furbo 360 and Furbo Mini contain a server-side request forgery vulnerability in the handling of TF_FQDN.json in the GATT interface. The attack can be performed remotely but is highly complex and difficult to exploit.

Tomofun Furbo 360 and Furbo Mini contain a vulnerability in the GATT Service component resulting in improper access controls. The attack can only be performed from the local network, and the exploit is publicly available.

A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected is an unknown function of the component Registration Handler. Such manipulation leads to denial of service. The attack can be executed directly on the physical device. The attack requires a high level of complexity. The exploitability is told to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.