CVE Vulnerability Catalog

An XSS vulnerability in School Management System (rolling release) exists in /student-view.php in the Edit Student Info Page component. Manipulation of the First Name argument causes XSS. Remote attack is possible, exploit is public.

An XSS vulnerability in Skuul School Management System up to version 2.6.5 exists in the SVG File Handler component in /dashboard/schools/1/edit. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. This affects an unknown functionality of the NFC Handler component. Manipulation can lead to the use of a hard-coded cryptographic key. The attack requires physical access to the device and is difficult to exploit.

W bibliotece libexpat do wersji 2.7.3, specjalnie przygotowany plik o przybliżonym rozmiarze 2 MiB może powodować znaczne opóźnienia w czasie przetwarzania, trwające nawet kilkanaście sekund.

Mustang before 2.16.3 allows exfiltrating files via XXE attacks.

Devolutions Server exposes credentials in unintended requests. The issue affects Server through 2025.2.20 and through 2025.3.8.

Spotipy, a Python library for the Spotify Web API, prior to version 2.25.2 contains a cross-site scripting (XSS) vulnerability in the OAuth callback server. The unsanitized error parameter allows JavaScript injection, enabling attackers to execute arbitrary JavaScript in the user's browser during OAuth authentication.

GitLab CE/EE in all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 contained an issue that could allow an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions. The vendor fixed the issue in versions 18.5.5 and 18.6.3.

In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the _internal index during the addition of new “Data Security Accounts”. The vulnerability requires either local access to log files or administrative access to internal indexes, which by default only the admin role receives.

In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the end, because of use of QIODevice::ReadWrite instead of QIODevice::WriteOnly.

VictoriaMetrics in versions from 1.0.0 before 1.110.23, from 1.111.0 before 1.122.8, and from 1.123.0 before 1.129.1 is vulnerable to DoS attacks because the snappy decoder ignored request size limits, allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability; the fix enforces block-size checks based on MaxRequest limits and is available in versions 1.110.23, 1.122.8, and 1.129.1.

Contao is an open source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into template output that will be executed in the browser in the front end and back end. The issue is patched in versions 4.13.57, 5.3.42, and 5.6.5.

IBM Sterling B2B Integrator and IBM Sterling File Gateway could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. The issue affects versions 6.0.0.0 through 6.1.2.7, 6.2.0.0 through 6.2.0.5, and 6.2.1.1.

Security Point (Windows) in MaLion prior to version 5.3.4 has an incorrect default permissions issue. A user able to log in to the system with the Windows client installed could place an arbitrary file in a specific folder; if it is a specially crafted DLL, arbitrary code could be executed with SYSTEM privilege.

A user with access to the cluster with a limited set of privilege actions may be able to terminate queries being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. The issue affects MongoDB Server v7.0 versions prior to 7.0.26 and v8.0 versions prior to 8.0.14.

A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When certain unexpected conditions trigger unhandled exceptions, the application returns detailed error messages and stack traces to the client. This may expose internal filesystem paths, SQL queries, database connection details, or environment configuration data to remote unauthenticated attackers. This issue allows information gathering and reconnaissance but does not enable direct system compromise.

A vulnerability was detected in Eigenfocus up to version 1.4.0 affecting unknown code of the Description Handler component. Manipulation of the entry.description/time_entry.description argument leads to cross-site scripting; the attack can be carried out remotely and the exploit has been publicly disclosed. Upgrading to version 1.4.1 (patch 7dec94c9d1f3e513e0ee38ba68caaba628e08582) resolves the issue.

A cross site scripting flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php, and manipulation of the cdetails argument leads to script execution. The attack can be launched remotely and the exploit has been published.

A vulnerability has been detected in jarun nnn up to version 5.1. The issue affects the function show_content_in_floating_window/run_cmd_as_plugin in the file nnn/src/nnn.c and leads to a double free. The attack requires local access.

The Secure Flag passed to Versal Adaptive SoC's Trusted Firmware for Cortex-A processors (TF-A) for Arm's Power State Coordination Interface (PSCI) commands were incorrectly set to secure instead of using the processor's actual security state. This would allow the PSCI requests to appear they were from processors in the secure state instead of the non-secure state.