CVE Vulnerability Catalog

The Simple multi step form module for Drupal contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from 0.0.0 before 2.0.0.

Mattermost versions 10.11.x <= 10.11.3 and 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin, allowing other users to determine when users had read channels via channel member objects.

A cross-site scripting vulnerability was found in SourceCodester Student Grades Management System 1.0 in /grades.php on the Add New Grade Page (Remarks argument). Remote exploitation is possible and the exploit has been publicly disclosed.

A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuestion.php. Manipulation of the argument Question results in cross-site scripting. It is possible to launch the attack remotely. The exploit has been released publicly and may be exploited.

A Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the reader to perform a denial-of-service attack against that specific reader, preventing cardholders from badging for entry. This issue affects Command Centre Server versions 9.30 prior to vCR9.30.251028a, 9.20 prior to vCR9.20.251028a, 9.10 prior to vCR9.10.251028a, and all versions of 9.00 and prior.

The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local unprivileged attacker could execute arbitrary code that inherits the TCC permissions assigned to Canva.

GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be problematic if the user selects an arbitrary proxy server without considering whether outbound HTTPS connections succeed even for untrusted or invalid certificates. In this scenario, integrity protection could be bypassed.

A cross-site scripting vulnerability was identified in code-projects Student Information System 2.0 in the /editprofile.php file. The attack can be launched remotely and a public exploit is available.

Simple Cafe Ordering System 1.0 by code-projects has a cross-site scripting (XSS) vulnerability in /add_to_cart. Manipulation of the product_name argument leads to XSS. The attack can be performed remotely, and the exploit has been publicly disclosed.

In GitLab CE/EE (versions from 16.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2), an authenticated attacker could cause a denial of service by submitting specially crafted markdown content with nested formatting patterns. The vendor has remediated the issue.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2. An authenticated attacker could bypass access control restrictions and view GitLab Pages content intended only for project members by authenticating through OAuth providers.

GitLab EE versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 contain a flaw that could allow an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2. An authenticated user could gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.

A weakness was identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. It impacts an unknown function of the file /dashboard/Ccustomer/manage_customer. Manipulation of the Search argument causes cross site scripting. The attack may be initiated remotely and the exploit is publicly available.

h3blog 1.0 by pojoin has a cross-site scripting (XSS) vulnerability in /admin/cms/category/addtitle. Manipulation of the Title argument leads to XSS. The attack can be performed remotely, and the exploit is publicly available.

h3blog 1.0 by pojoin has a cross-site scripting (XSS) vulnerability in /admin/cms/material/add. Manipulation of the Name argument leads to XSS. The attack can be performed remotely, and the exploit has been publicly disclosed.

A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320 affecting an unknown function of the file /edit_profile. Manipulation of the first_name/last_name arguments results in basic cross-site scripting; the attack can be initiated remotely and the exploit has been made public. The vendor did not respond to the disclosure.

A cross-site scripting vulnerability was found in SalesERP (Bdtask/CodeCanyon) up to version 20250728, affecting the /edit_profile file in the User Profile Handler component. Manipulation of the first_name/last_name arguments allows script injection. The attack can be carried out remotely and a public exploit is available.

An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the screenshot control feature of the browser. Browser self-protection should be enabled to mitigate this issue.

An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls.