CVE Vulnerability Catalog

An improper resource shutdown or release vulnerability exists in the Click Plus C2-03CPU-2 device running firmware 3.60. An unauthenticated attacker can exhaust all available Click Programming Software sessions and cause a denial-of-service.

An improper resource shutdown or release vulnerability was identified in the Click Plus C2-03CPU-2 device running firmware 3.60. An unauthenticated attacker can perform a denial-of-service attack by exhausting all available device sessions in the Remote PLC application.

An authorization bypass vulnerability was discovered in Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol used by the Remote PLC application, authenticated low-privilege users can read and modify PLC variables beyond their intended authorization level.

The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the software containing a hard-coded AES key used to protect the initial messages of a new KOPS session.

Cleartext storage of sensitive information was discovered in Click Programming Software version v3.60. The vulnerability can be exploited by a local user with access to the file system, while an administrator session is active, to steal credentials stored in clear text.

Kata Containers is a lightweight VM project. In versions 3.20.0 and before, a malicious host can bypass initdata verification. On TDX systems with confidential guests, a malicious host can selectively fail IO operations to skip initdata verification. This allows launching arbitrary workloads and attesting successfully to Trustee as any benign workload. Fixed in 3.21.0.

The astral-tokio-tar library up to version 0.5.3 contains a vulnerability that allows tar archives to extract outside of their intended destination directory when using the Entry::unpack_in_raw API. Additionally, the Entry::allow_external_symlinks control (default true) could be bypassed via a pair of symlinks that individually point within the destination but combine to point outside of it. These behaviors could be used to perform an arbitrary file write and potentially pivot into code execution.

WordPress versions from 4.7 through 6.8.2 are vulnerable to stored XSS due to improper neutralization of input during web page generation. The vulnerability requires Author or higher privileges to exploit.

The Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.

The DNN (formerly DotNetNuke) CMS platform in versions prior to 10.1.0 improperly handles URLs/paths and template rendering, allowing specially crafted input to be reflected into a user profile returned to the browser. The application does not sufficiently neutralize or encode HTML-significant characters, enabling an attacker to have victim browsers interpret attacker-controlled content as part of the page's HTML. The issue has been patched in version 10.1.0.

DNN (formerly DotNetNuke) is a CMS platform. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to JavaScript injection, affecting unsuspecting users clicking such links. This issue has been patched in version 10.1.0.

DNN (formerly DotNetNuke) is a CMS platform. Prior to version 10.1.0, the CKEditor file upload endpoint has insufficient filename sanitization allowing network endpoint probing. A crafted request can upload a file with Unicode characters translated into a path that could expose internal network resources. This is patched in version 10.1.0.

DNN (formerly DotNetNuke), an open-source web content management platform (CMS) in the Microsoft ecosystem, prior to version 10.1.0 allowed users to inject JavaScript code in the Biography field, even if that field is not rich-text. The injected code would run in the context of the website for any user viewing the profile, including administrators and/or superusers. This issue has been patched in version 10.1.0.

WordPress Core contains an Insertion of Sensitive Information Into Sent Data vulnerability that may allow retrieval of embedded sensitive data. The issue affects versions from 4.7 through 6.8.2 and requires Contributor-level privileges to exploit. The WordPress Core security team is aware and working on a fix; this is a low-severity vulnerability.

A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. A malicious actor can exploit this vulnerability by injecting a crafted payload that is reflected in the server response, enabling the execution of arbitrary JavaScript in the victim's browser.

Cross-site scripting (XSS) vulnerability in YzmCMS through version 7.3, located in the referer header on the registration page. It allows an attacker to inject malicious script into the victim's browser.

A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptographic key used across all tenants to sign authentication cookies allows a privileged user in one tenant to forge authentication cookies for users in other tenants.

An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to SOAP admin services can deploy a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server.

An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.

W podatności CVE-2025-9342 występuje obejście autoryzacji poprzez klucz kontrolowany przez użytkownika w aplikacji AHE Mobile firmy Anadolu Hayat Emeklilik Inc., co umożliwia nadużycie uprawnień. Problem dotyczy wersji AHE Mobile od 1.9.7 do przed 1.9.9.