CVE Vulnerability Catalog

A vulnerability was determined in ggml-org llama.cpp bec4772f6 in the rpc_server::graph_compute function of ggml/src/ggml-rpc/ggml-rpc.cpp of the ggml-RPC Server component. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.

A vulnerability in CTFd up to 3.8.4 in the _is_safe_url function of the CTFd/utils/validators/__init__.py file. Manipulation of the Next argument leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch name is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.

A vulnerability in code-projects Barangay Resident Profiling Management System 1.0 in an unknown function of the /boarders.php file of the Boarder Management Module component. Manipulation of the ID argument leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used.

A vulnerability in code-projects Barangay Resident Profiling Management System 1.0 in an unknown function of the /archived_records.php file of the Restore/Delete component. Manipulation of the resident_id argument results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used.

A vulnerability in Dromara UJCMS up to 10.1.3 in the update function of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the web-file-template Endpoint component. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.

A vulnerability in Reverse::Proxy versions before 0.04 for Perl: HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. PSGI hands PATH_INFO percent-decoded, so a %XX sequence becomes a raw byte. The proxy appends that byte string to the upstream base URL, and for an Upgrade tunnel writes it into a request line it serializes itself, re-encoding nothing. A path containing %0d%0a arrives at the upstream as a CRLF that ends the request line, and a decoded space, '?' or '#' truncates it the same way. Everything the client writes after the CRLF is read by the upstream as a second request.

justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation XSS (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() with a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out and inject arbitrary HTML. The default sanitization policy is not affected because it drops the contents of style and script.

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.

justhtml before version 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.

justhtml before version 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG <foreignObject>, MathML <annotation-xml encoding="text/html">) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter="url(...)" and preserved <style> could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.

justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as <style>). Specially crafted input can sanitize into markup that appears safe but becomes unsafe when re-parsed by a browser or another HTML parser, allowing markup injection. The default safe configuration (sanitize=True) is not affected. Fixed in 1.14.0.

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.

A vulnerability in SourceCodester Class and Exam Timetabling System 1.0 in the file /admin/edit_user_account.php (User Account Update component) allows manipulation of the id/username argument, leading to improper authorization. The attack may be launched remotely.

A vulnerability in itsourcecode Hospital Management System Project in PHP 1.0 in the file /viewservicetype.php allows manipulation of the delid argument, causing SQL injection. The attack may be initiated remotely.

The Brave Popup Builder plugin up to version 0.8.5 has a broken access control issue. Any logged-in user, even Subscriber or WooCommerce Customer, can read popup content they shouldn't have access to by passing a post ID in the URL.

The WooCommerce Bookings WordPress plugin before version 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. The function buildImapConfig in lib/email-sync/imap-client.ts is vulnerable to server-side request forgery via manipulation of host/port arguments. The attack can be launched remotely. A pull request to fix this issue awaits acceptance.

A vulnerability was found in SourceCodester Stock Management System 1.0. The file /php_action/getOrderReport.php is vulnerable to cross-site scripting via manipulation of clientName/clientContact arguments. The attack can be initiated remotely and the exploit has been made public.

A vulnerability has been found in SourceCodester Stock Management System 1.0. The file /php_action/printOrder.php is vulnerable to cross-site scripting via manipulation of clientName/clientContact arguments. The attack may be performed remotely and the exploit has been disclosed publicly.

A flaw has been found in sambitraj Student-Management-System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The Management Mutation Handler is vulnerable to SQL injection via manipulation of roll_no/name/father_name/class/mobile/email/password/remark arguments. The attack can be carried out remotely. The exploit has been published and may be used. The project has not responded.