CVE Vulnerability Catalog

The Ninja Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files, allowing unauthenticated attackers to delete those files if they can trick an administrator into clicking a link.

The Team Members plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first and last name fields in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping.

IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Wazuh versions starting from 3.8.0 to before 4.11.0 have a heap buffer overflow vulnerability in wazuh-analysisd when parsing XML elements from Windows EventChannel messages. This is patched in version 4.11.0.

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-dispensas. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argument aluno_id causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

itsourcecode Open Source Job Portal 1.0 has an SQL injection vulnerability in /admin/user/index.php?view=edit. Manipulating the ID argument leads to SQL injection.

A SQL injection vulnerability was identified in itsourcecode Online Clinic Management System 1.0 in the /details.php?action=post file. Manipulation of the ID argument allows remote exploitation. The exploit has been made public.

A vulnerability was determined in Jinher OA 2.0 in an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes XML external entity reference. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability was found in Dibo Data Decision Making System up to version 2.7.0. It affects the downloadImpTemplet function in the file /common/dep/common_dep.action.jsp. Manipulation of the filePath argument leads to path traversal. The attack can be launched remotely, and the exploit has been made public.

DataTables up to 1.10.13 contains a path traversal vulnerability in /examples/resources/examples.php. Manipulation of the src argument causes path traversal. The attack can be initiated remotely, and the exploit has been published and may be used. Upgrading to version 1.10.15 is sufficient to fix this issue. The DataTables vendor advises upgrading and notes that deploying that file to a server is not recommended.

A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."

Flag Forge CTF platform versions 2.0.0 to before 2.3.2 expose user email addresses in the JSON response of the public endpoint /api/user/[username]. The fix, available from 2.3.2, removes emails from public API responses. No workarounds exist.

Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on default installations; theoretically users of third-party LaTeX-rendering extensions could be vulnerable to reverse tabnabbing attacks if those extensions generated links with target=_blank.

A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the Image Handler component. Manipulation results in information disclosure. Remote exploitation is possible and the exploit has been released publicly.

Podatność CVE-2025-6396 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Webbeyaz Website Design, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy oprogramowania do projektowania stron internetowych do 14 lipca 2025 roku.

A vulnerability in Four-Faith Water Conservancy Informatization Platform 1.0 affects an unknown function in /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Manipulation of the fileName argument leads to path traversal. The attack can be launched remotely and the exploit is public.

kalcaddle kodbox up to version 1.61.09 has a path traversal vulnerability in the fileOut function in app/controller/explorer/index.class.php. Manipulation of the path argument allows remote attack. The exploit has been publicly disclosed and may be used. The vendor was contacted but did not respond.

A weakness has been identified in Ogre up to version 14.4.1 in the STBIImageCodec::encode function of /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. Manipulation causes mismatched memory management routines. The attack requires local execution and the exploit is publicly available.

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.