CVE Vulnerability Catalog

A vulnerability in JhumanJ OpnForm up to 1.9.3 affects an unknown function of the HTTP Header Handler component. Manipulation of the X-Forwarded-For argument leads to improper restriction of excessive authentication attempts. The attack can be carried out remotely but requires high complexity and is difficult to exploit. The exploit is publicly available. A patch is identified as 11e99960e14ca986b1a001a56e7533223d2cfa5b.

A flaw in JhumanJ OpnForm up to 1.9.3 affects an unknown part of /api/open/forms/ of the Form Editor component. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published. The vendor has stated that the feature is disabled until the user configures their own domain, which mitigates the attack vector.

A cross-site scripting (XSS) vulnerability was discovered in itsourcecode Leave Management System 1.0 in the redirect function of /module/employee/controller.php?action=reset. Manipulating the ID argument allows remote attack execution. The exploit has been published and may be used.

A cross-site scripting (XSS) vulnerability was discovered in projectworlds Advanced Library Management System 1.0 in an unknown function of /edit_admin.php. Manipulating the firstname argument allows remote attack execution. The exploit is publicly available and may be used.

A flaw in code-projects Voting System 1.0 affects an unknown function in /admin/candidates_edit.php. Manipulation of Firstname/Lastname/Platform arguments causes cross site scripting. Remote exploitation is possible. The exploit has been published.

In Deno versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It is possible to retrieve stats from files the user does not have explicit read access to, even when the script is executed with `--deny-read=./`. Versions 2.5.3 and 2.2.15 fix the issue.

In Deno versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It is possible to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with read-only permission and write operations are not allowed. Versions 2.5.3 and 2.2.15 fix the issue.

A vulnerability was determined in GNU Binutils 2.45 in the function get_link_hash_entry of the file bfd/elflink.c of the Linker component. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed. Upgrading to version 2.46 addresses this issue.

A vulnerability was found in GNU Binutils 2.45 in the function elf_link_add_object_symbols in bfd/elflink.c of the Linker component. The manipulation results in an out-of-bounds read. The attack requires local access. The exploit has been made public and could be used. Upgrading to version 2.46 addresses the issue.

A vulnerability has been found in GNU Binutils 2.45 in the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the Linker component. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc.

In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).

The YoSmart YoLink application (through 2025-10-02) has session tokens with unexpectedly long lifetimes.

The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can read a boot log that includes network access credentials.

A vulnerability in OpenSSH before version 10.1 allows the null character ('\0') in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

A vulnerability in OpenSSH before version 10.1 allows control characters in usernames from potentially untrusted sources, such as the command line or %-sequence expansion in configuration files. This can lead to code execution when a ProxyCommand is used.

A vulnerability was identified in Online Banking System (up to version 57437e6400ce0ae240e692c24e6346b8d0c17d7a) in an unknown function of /customer_add_action.php, within the add customer component. Manipulation of the First Name argument leads to cross-site scripting (XSS). Remote exploitation is possible, and the exploit is publicly available.

A cross-site scripting (XSS) vulnerability was found in CmsEasy up to version 7.7.7 in the lib/inc/view.php library of the URL Handler component. Manipulating the PHP_SELF argument can lead to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.

When an error occurs in the application, a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker thus receives information about the technology used and the structure of the application.

A user with appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms, or restrictions to limit the creation.

A vulnerability in Mangati NovoSGA up to 2.2.12 affects the user creation page (/novosga.users/new). Manipulation of the Senha/Confirmação da senha arguments leads to weak password requirements. The attack is remote but difficult to exploit.