CVE Vulnerability Catalog

A DOM-based Cross-Site Scripting attack is possible against Stormshield's web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of an out-of-bounds read.

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This allows an attacker to repeatedly attempt password guesses for a user account without adequate restrictions.

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the update_license AJAX action in all versions up to and including 5.2.0 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages.

ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.

A DOM-based cross-site scripting (XSS) vulnerability in LIFF SDK versions 2.20.0 through 2.31.0 allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of authentication tokens or application data, or unauthorized actions using the user's session.

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme, producing a stored or reflected cross-site scripting vector. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3.

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten. This can bypass host-based policies such as denylists, loopback filtering, redirect validation, or outbound proxy routing. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3.

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

Hidden functionality exists in multiple DVRs provided by Atsumi Electric Co., Ltd. A user who can log in with administrator privileges may upgrade the affected product to unauthorized firmware.

UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition.

An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0. An authenticated attacker can escalate privileges by modifying the login_privilege data on the affected device.

Missing authentication for a critical function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests. The router returns device identification information and switches into a specific mode, which may prevent self-recovery under abnormal conditions.

An out-of-bounds write issue was addressed with improved bounds checking. The issue is fixed in macOS Sequoia 15.8 and macOS Tahoe 26.7. An app may be able to cause unexpected system termination.

A privacy issue was addressed with improved checks. The issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.

An authorization issue was addressed with improved state management. The flaw affects iOS 27, iPadOS 27 and macOS Golden Gate 27. An app may be able to access sensitive user data.

An out-of-bounds read was addressed with improved bounds checking. The flaw affects iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination.

A denial-of-service issue was addressed with improved input validation. The flaw affects iOS 26.7, iPadOS 26.7, iOS 27 and iPadOS 27. An attacker in a privileged network position may be able to cause a denial-of-service.