CVE Vulnerability Catalog

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets is the configured base.

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.

Cleartext storage of sensitive information vulnerability in Cryptosim by Kriptok Crypto and Information Technologies Industry Trade Inc. allows retrieving embedded sensitive data. This affects versions before 3.1.0.229.

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5.

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.2 is capable of addressing this issue.

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server. The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4.

cowlib (Erlang) versions 2.9.0 through 2.20.0 fail to escape values inserted into the Link: header in cow_link:link/1. Special characters in the URI, rel, or attribute keys can be injected into the header, allowing additional Link directives to be smuggled. As a result, victim browsers may be forced to make connections to attacker-controlled resources.

A weakness has been identified in OpenBoxes up to 0.9.2 in the Product Supplier Edit Controller component, in the file RoleInterceptor.groovy. Manipulation can lead to improper authorization. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability has been found in SourceCodester Online Examination & Learning Management System 1.0, affecting an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely.

A vulnerability has been detected in sonos tract up to 0.23.4, impacting the function Tensor::from_raw_dt_align of the file data/src/tensor.rs in the ONNX Initializer Loader component. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely and the exploit has been disclosed publicly. The patch is identified as 66b10bda8895f4bfaf8c205361f0125cdf51f99b.

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22, affecting the function convert_gguf_to_hf_tokenizer of the file mistralrs-core/src/gguf/gguf_tokenizer.rs in the GGUF Tokenizer component. Manipulation of the arguments eos_token_id/bos_token_id/unknown_token_id results in out-of-bounds read. The attack can be executed remotely and the exploit is now public. Upgrading to version 0.8.23 can resolve this issue.

A vulnerability was determined in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewbilling.php. Manipulation of the argument delid leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewdepartment.php. Manipulation of the argument delid results in SQL injection. The attack can be initiated remotely and the exploit has been made public.

A SQL injection vulnerability was found in itsourcecode Hospital Management System 1.0 in the file /viewroom.php. Manipulation of the argument delid in an unknown function allows remote attack execution. The exploit has been publicly disclosed and may be used.

A basic cross-site scripting (XSS) vulnerability was found in Webkul Bagisto up to 2.4.4 in the file /customer/register, in the Customer-Registration Notification Email component. Manipulation of the first_name/last_name arguments allows remote attack. The exploit has been published and may be used. The vendor confirms the issues were already identified internally and are being addressed.

A vulnerability was found in Webkul Bagisto up to 2.4.4 in the file /customer/account/rma/store, involving enforcement of behavioral workflow. Manipulation of the rma_qty/resolution_type/rma_reason_id arguments allows remote attack. The exploit is now public and may be used. The vendor confirms the issues were already identified internally and are being addressed.

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. It affects an unknown part of the file /BSHRM1.php. Manipulation of the argument course results in cross site scripting. Remote exploitation is possible, and the exploit is publicly available.