CVE Vulnerability Catalog

A vulnerability was detected in sambitraj Student-Management-System. Unknown functionality of the Dashboard component allows manipulation of roll_no/teacher_name arguments, leading to SQL injection. The attack can be executed remotely, and the exploit is now public.

A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIT2.php. Manipulation of the course argument leads to XSS. Remote exploitation is possible, and the exploit has been publicly disclosed.

A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIS1.php. Manipulation of the course argument leads to XSS. The attack can be launched remotely, and the exploit has been made public.

A vulnerability was found in alexta69 MeTube up to 2026.06.10. An unknown function in the file /download/.metube/cookies.txt of the Cookie File Handler component allows files or directories to be accessible. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 2026.06.20 resolves the issue.

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.9.8 via the get_image_src_in_base64 function. This allows authenticated attackers with subscriber-level access or above to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints.

The Infineon Airoc Wi-Fi driver has a buffer leak vulnerability in the airoc_mgmt_send() function. On every failed packet transmission, a buffer from the small fixed pool is not released, leading to pool exhaustion. Once the pool is exhausted, both transmit and receive paths fail, causing permanent loss of Wi-Fi connectivity until the device is rebooted.

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.

Joomla Extension Fabrik before version 4.7.2 contains a vulnerability allowing unauthenticated disclosure of commenters' email addresses. The onGetEmail endpoint does not perform any access checks.

The Joomla extension Fabrik before version 4.7.2 has a vulnerability due to missing access controls in the form.inlineedit controller, allowing unauthenticated users to read form data.

Joomla Extension Fabrik before version 4.7.2 contains a vulnerability allowing unauthenticated row reordering. The order plugin does not perform any access checks.

Joomla Extension Fabrik before version 4.7.2 contains a vulnerability allowing unauthenticated deletion of any comment. The DeleteComment endpoint does not perform any access checks.

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. Path validation is lexical and does not account for symlink resolution.

hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity.

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation.

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.

NLTK before version 3.10.2 contains a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb_update_global_wp_settings' function that only verifies the 'edit_posts' capability instead of requiring administrative privileges. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global WordPress theme color settings site-wide, leading to site defacement.

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.