CVE Vulnerability Catalog

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content.

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened.

The Mediawiki - Thanks Extension before versions 1.43.10, 1.45.5, and 1.46.1 contains a Stored XSS vulnerability due to improper input neutralization during web page generation.

A flaw in the AgenticScopeSerializer.fromJson function in the LangChain4j-agentic component causes a deserialization issue. Remote exploitation is possible but complex and difficult. The issue is fixed in versions 1.5.3-beta11, 1.11.10-beta19, and 1.18.1-beta28. The exploit has been published and may be used.

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call anon.hash() and collect (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. The issue is fixed in version 3.2.3.

InvoicePlane 1.7.2-beta-1 stores client_email without enforcing email syntax and renders it unescaped inside double-quoted value attributes in the invoice and quote mailer forms. An administrator who can edit a client can store attribute-breaking input, and when the mailer is configured, JavaScript executes when another authenticated administrator opens the related mailer page. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane's User_Controller compares the session user_type value with the required role using PHP's loose inequality operator. Under a non-standard session backend that returns unexpected scalar types, type juggling can cause a value that is not strictly the required role to pass the authorization check. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane's Cron::recur() method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can place forged log lines into the audit trail, potentially corrupting forensic records and interfering with log-based monitoring. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane omits ensure_valid_post_request() from delete methods including Payments::delete(), Recurring::delete(), and User_clients::delete(). Although the routes require POST, they do not validate the request's CSRF token. An attacker can submit a cross-origin form through an authenticated administrator's browser to delete financial records and other application data. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests /invoices/recurring/stop/{id}, the application stops the selected recurring invoice. An attacker can target multiple identifiers to interrupt recurring billing and cause financial loss. Fixed in version 1.7.2.

RabbitMQ versions from 4.2.0 until 4.2.8 and 4.3.2: a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site.

Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom_field_table value without validating it against the allowed custom-field table names. Mdl_custom_fields::used() later concatenates that stored value into the FROM table and WHERE column identifier positions, so opening the custom-field edit form executes a second-order SQL injection. The injection can query arbitrary schema data and can cause application errors or denial of service. Fixed in version 1.7.2.

InvoicePlane before version 1.7.2 stores and serves uploaded images without stripping EXIF metadata. When an administrator shares an image with another user, the recipient can retrieve GPS coordinates, timestamps, and device information. The vulnerability is fixed in version 1.7.2.

Input Leap through version 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal. This can result in code execution if a file is written to a startup directory via a DDRG message.

A weakness has been identified in Zhonglun CloudPOS 3.0 in the Automatic Update component (file Program.cs). Manipulating the version/url/packagekey/package name arguments can lead to channel accessible by non-endpoint. The attack can be launched remotely, is highly complex, and exploitation appears difficult. The exploit has been made public.

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw.

Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(), leading to memory corruption and application termination or denial of service in RELEASE/NO_ASSERT builds.

In the Linux kernel, the smb2_tree_connect() function of the SMB server (ksmbd) leaks a tree connection. When ksmbd_iov_pin_rsp() fails, the newly created tree connection is not disconnected, leading to a resource leak.

In the Linux kernel, the nvdimm (pmem) pmem_submit_bio() function records a REQ_PREFLUSH error but continues to copy bio data and can later overwrite the error with a successful REQ_FUA flush. This allows data writes to run after a failed preflush and can complete the bio successfully despite the failed ordering barrier.