CVE Vulnerability Catalog

The E-Commerce Platform of Dayneks Software Industry and Trade Inc. has a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 28082026. The vendor was contacted but did not respond.

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.4.4. The load_previous_field_value() method accepts arbitrary URL values from $_POST data for upload fields without domain restriction, which are then passed to wp_remote_head(). This allows unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs.

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 before 4.6.001.

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to and including 1.12.4 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Author-level access or above to inject arbitrary web scripts that execute whenever a user accesses a page displaying the gallery with a description enabled.

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting in Stored Cross-Site Scripting (XSS). When an administrator reviews comments in the back office, the payload executes with admin-level session context, leading to full store compromise.

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function.

Morgan, an HTTP request logger middleware for Node.js, in versions prior to 1.12.0 did not neutralize the Unicode line separator characters U+0085, U+2028, and U+2029 in log token values. An unauthenticated remote client can place these characters in an attacker-controlled log token, such as a Basic auth username, causing downstream log processing to split a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078. The issue is fixed in morgan 1.12.0.

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades.

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.

Vulnerability in gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. The checkout() function follows an existing terminal symlink during incremental materialization, allowing overwriting files outside the worktree.

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server goroutines and exhaust connection resources.

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.

A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The function fs.readFileSync in src/index.ts of the upload_image component is vulnerable to path traversal via manipulation of the image_path argument. The attack can be initiated remotely. The exploit is public. Upgrading to version 1.5.1 fixes the issue.

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor from n/a through 6.8.0.

WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings, causing viewers to be redirected to a phishing site or shown a spoofed message.

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.