CVE Vulnerability Catalog

A cross site scripting vulnerability was determined in code-projects Client Details System 1.0. An unknown function of the file /admin/clientview.php is impacted. The attack can be launched remotely and the exploit has been publicly disclosed.

A cross site scripting vulnerability was found in code-projects Client Details System 1.0. The issue affects some unknown processing of the file /update-clients.php. The attack can be initiated remotely and the exploit has been made public.

A vulnerability in code-projects Client Details System 1.0, affecting unknown code in the file /welcome.php. Such manipulation leads to cross-site scripting (XSS). The attack may be performed remotely. The exploit has been disclosed publicly.

ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.

A cross-site scripting (XSS) vulnerability was found in LearnHouse up to version 98dfad76aad70711a8113f6c1fdabfccf10509ca in the /dash/org/settings/previews file of the Account Setting Page component. Manipulation leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.

In Wisencode up to version 20251012, an unknown function in /support-ticket/create of the Create Support Ticket Handler component allows cross-site scripting via manipulation of the Message argument. The attack can be launched remotely, and the vendor did not respond to the disclosure.

A cross-site scripting vulnerability was found in an unknown function of the Admin UI component in OpenWGA 7.11.12 Build 737. The attack can be initiated remotely and the exploit has been publicly disclosed.

A cross site scripting vulnerability has been detected in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/expense_categories/create on the Expense Categories Page is affected. The attack can be launched remotely and the exploit has been publicly disclosed.

A cross site scripting weakness has been identified in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/currencies/create on the Currency Page is impacted. The attack can be initiated remotely and the exploit has been made publicly available.

A cross site scripting security flaw has been discovered in projectworlds Expense Management System 1.0. It affects an unknown function of the file /public/admin/roles/create on the Roles Page. The attack can be performed remotely and the exploit has been released to the public.

A cross site scripting vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create on the Users Page. The attack can be carried out remotely and the exploit is publicly available.

A cross site scripting vulnerability was determined in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. The attack can be executed remotely and the exploit has been publicly disclosed.

A flaw has been found in Iqbolshoh php-business-website up to commit 10677743a8dfc281f85291a27cf63a0bce043c24. The vulnerability affects unknown code in admin/contact.php. Manipulation of the argument twitter causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The product uses a rolling release model, so specific version information is not available. The vendor was contacted but did not respond.

In Kamailio 5.5, the yyerror_at function in src/core/cfg.y (grammar rule handler) causes a null pointer dereference. The attack requires local access and manipulation of configuration files. The vulnerability's existence is questioned, and the vendor did not respond.

A flaw in Kamailio 5.5 in the rve_is_constant function of src/core/rvalue.c causes a null pointer dereference. The attack requires local access and manipulation of configuration files. The vulnerability's existence is still questioned, and the vendor did not respond to the disclosure.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1. Under certain conditions, authenticated users could gain unauthorized project access by exploiting the access request approval workflow.

GitLab EE versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 contained an issue that could allow an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions. The issue has been remediated.

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress up to version 4.8.4 is vulnerable to unauthorized data modification due to insufficient capability checks in the post_deactive() and post_activate() functions. This allows authenticated attackers with Editor-level access or above to activate and deactivate licenses.

The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to and including 2.7.11. This is due to trusting client-controlled HTTP headers in the pp_get_ip_address() function when the "Use transients" feature is enabled. Attackers can bypass authorization by spoofing these headers with the IP of an authenticated user.

Wasmtime, a runtime for WebAssembly, contains a vulnerability in versions from 38.0.0 to before 38.0.3. A bug in the implementation of component-model related host-to-wasm trampolines allows carefully crafting a component that, when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched. There are no workarounds.