CVE Vulnerability Catalog

A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The mysqli_query function in individual_report_search.php is affected by manipulation of the roll_number argument leading to SQL injection; the attack may be launched remotely and the exploit is publicly available.

In file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df), the store function in app/Http/Controllers/FileController.php allows unrestricted file upload via manipulation of the File argument. The exploit has been publicly disclosed and can be launched remotely.

The DigitalME eRoom plugin (eroom-zoom-meetings-webinar) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects eRoom versions up to and including 1.7.1.

Nuxt framework versions 3.13.0 through 4.6.2 contain a vulnerability where the server-island renderer serializes raw useHeadSafe entry input without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application passing attacker-controlled data to useHeadSafe in a .server.vue component or one rendered through NuxtIsland can render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. The issue is fixed in version 4.6.2.

In Nuxt prior to 4.6.2, pages are resolved case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively. A request differing only by letter case can render without the intended server rule, skipping redirects, headers, proxy, ssr: false, and noScripts. Applications setting router.options.sensitive: true in nuxt.config are not affected.

Nuxt, an open-source web development framework for Vue.js, from 3.11.0 until 3.21.4 and 4.4.4 compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters. This allows a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path, so appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data.

In Nuxt before 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to the to attribute is prefixed with an ASCII C0 control character. The no-pages router classifies the value as an internal route before the earlier protocol check and passes it to the rendered anchor href; browsers strip the leading control character and interpret the remaining javascript: URL. This is fixed in version 4.6.0.

In stream-json from 2.0.0 until 3.7.0, FlexAssembler joins the full key stack on every container start, causing quadratic CPU consumption for deeply nested documents. The join occurs before rule matching, so the attacker need not know the schema; only consumers using string or regex path filters are affected.

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values, allowing injection of arbitrary HTML and JavaScript. The issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components, and can produce reflected or stored cross-site scripting under the application's origin.

In Astro from 7.1.0 until 7.3.3, the server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application passing attacker-controlled data into properties such as duration, delay, easing, direction, fillMode, or animation names can allow CSS delimiters to terminate the declaration and add attacker-selected rules to the server-rendered page. The injected CSS can conceal or reposition content, add generated text, and otherwise misrepresent the interface. This is fixed in 7.3.3.

Storybook from 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6 allows the development server to expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files, and with the Vitest addon, the payload can use a Vitest API to write files or execute commands, leading to code execution with developer privileges.

Storybook is a frontend workshop for building UI components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server due to insufficient iframe embedding and message-origin restrictions. A developer must visit the malicious website and interact with the injected interface.

In Electron prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker with code execution in the GPU process could supply inconsistent frame geometry and cause the main process to read out-of-bounds memory, disclosing memory or crashing the application.

H5P through 1.17.9 contains an Authorization Bypass Through User-Controlled Key vulnerability that allows exploiting incorrectly configured access control security levels.

The vulnerability in NoMachine Device Service stems from incorrect permissions on a named pipe. A local attacker able to execute low-privileged code can exploit this flaw to escalate privileges and execute arbitrary code in the context of SYSTEM.

The rtpL16depay element in GStreamer has a heap-based buffer overflow due to missing validation of user-supplied data length before copying. This allows a remote attacker to execute arbitrary code in the context of the current process.

The multicluster-global-hub-operator-bundle operator is configured with overly broad RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to escalate privileges and gain full administrative control over the cluster.

In Apache Pulsar, when package management is enabled, the Functions worker authorized requests to register or update functions, sources and sinks only against the namespace where the component was being registered, without checking whether the requesting user could access the package referenced by the package URL. The package was retrieved from the broker using the worker's own credentials, so the Packages Management Service permission check applied to the worker's identity rather than the requesting user's. An authenticated user could thereby obtain the contents of a package stored in another tenant's namespace without having the required permissions.

The Apache Pulsar WebSocket service allows an authenticated user holding CONSUME permission on any topic to configure a dead letter policy with an arbitrary deadLetterTopic. The service does not verify the user's PRODUCE permission on that topic and writes dead letter messages using its own broker client identity, enabling injection of messages into topics the user is not permitted to produce to, including namespaces of other tenants.

The Apache Pulsar broker did not check authorization for the GetSchema and GetOrCreateSchema binary protocol commands, verifying only that the client was authenticated. An authenticated client without permissions on the target topic could read a schema from another namespace or tenant, or register a new schema version, potentially causing schema incompatibility errors for legitimate producers and consumers. The issue affects deployments with authorization enabled in versions 2.2.0–4.0.13, 4.1.0–4.1.3, and 4.2.0–4.2.4.