CVE Vulnerability Catalog

Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

TurkHotspot by MRV Technology Foreign Trade Ltd. Co. contains a Reflected XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions through 2026-10-02. The vendor was contacted but the product is not supported.

Missing authorization vulnerability in the LearnPress WordPress plugin, allowing exploitation of incorrectly configured access control security levels.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing. This issue affects Aculect AI Companion: from n/a through 0.8.2.

PublishPress Series (WordPress plugin) through version 3.1.3 has an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels.

WebSamurai (WordPress plugin) through version 1.0.7 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Airano MCP Bridge (WordPress plugin) through version 2.11.0 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Smart One Click Setup – Complete Demo Import & Export (WordPress plugin) through version 1.4.3 has a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data.

onetwothreeneth HospitalManagementSystem (up to 9ef91ed6007314b6473110ed699dff76d158f61d) has a vulnerability in php/sessions.php where manipulation of the ID argument leads to improper authentication. Remote exploitation is possible and the exploit has been publicly disclosed.

A SQL injection vulnerability was discovered in CodeAstro Simple Loan Management System 1.0 in the file /admin/index.php, affecting the g_name argument. The attack can be performed remotely, and the exploit is publicly available.

A path-traversal vulnerability in the logback-classic module (Java) allows writing log files outside the intended directory when an MDC-based discriminator value (e.g., from an HTTP header) flows unsanitized into a nested FileAppender path. Affects versions from 0.9.14 through 1.6.4.

A SQL injection vulnerability was discovered in CodeAstro Simple Pharmacy Management System 1.0 in the file /SimplePharmacy-PHP/product/delete.php, affecting the ID argument. The attack can be performed remotely, and the exploit is publicly available.

A SQL injection vulnerability was discovered in CodeAstro Simple Pharmacy Management System 1.0 in the file /SimplePharmacy-PHP/product/view.php, affecting the ID argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

A missing authorization vulnerability in AVEZ Electronics' Learning Management System (LMS) allows exploiting incorrectly configured access control security levels. Affects versions through 2026-09-18.

A resource allocation without limits or throttling vulnerability in Apache Thrift Delphi bindings buffered transport may lead to resource exhaustion. Affects versions before 0.25.0.

A vulnerability in Apache Thrift C++ bindings involves allocation of resources without limits or throttling and improper handling of highly compressed data (data amplification). Affects versions before 0.25.0.

An observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack before 5.03.01.54.

A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Student Result Management System 1.0 in the Announcement Module, in the file script/academic/core/new_announcement.php, affecting the title/announcement arguments. The attack can be performed remotely, and the exploit is publicly available.

A stored XSS vulnerability in ThemeREX Addons (trx_addons) by ThemeREX Group allows persistent injection of malicious scripts. Affects versions from n/a through 2.46.0.

The ThemeREX Addons plugin (up to and including version 2.46.0) is vulnerable to Server-Side Request Forgery (SSRF). This allows an attacker to force the server to make requests to resources it should not normally access.