CVE Vulnerability Catalog

A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

YznCMS v1.1.0 has a Cross-Site Request Forgery (CSRF) vulnerability in the /public/admin/profile/update.html component, allowing attackers to arbitrarily change the Administrator password via a crafted POST request.

A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Bagecms v3.1.0 has a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module.

A XSS vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web scripts or HTML via the File Upload function.

Novu has an open redirect vulnerability in the 'Sign In with GitHub' functionality in versions prior to 0.16.0. An attacker could force a victim to open a malicious URL, potentially logging into the repository under the victim's account.

TravianZ through version 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.

Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks, allowing ordinary users to execute operations reserved for space or project administrators.

Vulnerability in the hang detector module related to kernel raw address leakage. Successful exploitation of this vulnerability may affect service confidentiality.

Vulnerability related to incomplete verification of apps' permissions to access a certain API in the wireless projection module. Successful exploitation of this vulnerability may affect some wireless projection features.

A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository fossbilling/fossbilling prior to version 0.5.4.

In the GitHub repository it-novum/openitcockpit prior to version 4.6.6, there is a vulnerability related to sensitive cookies in HTTPS sessions that lack the 'Secure' attribute.

Statamic is a flat-first content management system powered by Laravel and Git. In versions prior to 4.10.0, the SVG tag does not sanitize malicious SVG, allowing attackers to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.

Uptime Kuma, a monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. This allows authenticated users to delete files from the server, potentially leading to data loss and system unavailability.

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker could craft malicious payloads to achieve command injection when entering the container terminal.

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories.

Pandoc, a Haskell library for converting markup formats, has an arbitrary file write vulnerability that can be triggered by a specially crafted image element in the input. This affects versions from 1.13 to 3.1.4 when generating files using the `--extract-media` option or outputting to PDF format.

Taocms versions up to 3.0.2 are vulnerable to Cross Site Scripting (XSS), allowing attackers to inject malicious code into the application.

MechanicalSoup is a Python library for automating interaction with websites. In versions from 0.2.0 to prior to 1.3.0, a malicious web server can read arbitrary files on the client using an `<input type="file" ...>` inside an HTML form.