CVE Vulnerability Catalog

In SourceCodester Online Clothing Store, there is a vulnerability in the /_notes/ file (Dreamweaver Metadata Files component) that allows remote disclosure of file and directory information.

A vulnerability in WonderTrader up to 0.9.9 affects the _undone_qty function in src/WtCore/TraderAdapter.h of the Pending Order Handler component. Manipulation of the getUndoneQty argument leads to enforcement of behavioral workflow. The attack can be carried out remotely, and the exploit is publicly available.

go-git is a git implementation library in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths, so a maliciously crafted reference name can cause writes outside the intended directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

SvelteKit is a framework for rapidly developing robust web applications using Svelte. Prior to 2.70.2, the content negotiation header parser uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.

A vulnerability was found in WonderTrader up to version 0.9.9, affecting the TraderATP Cash Trade Conversion in src/Includes/WTSTradeDef.hpp. Manipulating the m_offsetType argument leads to use of an uninitialized variable. The attack can be executed remotely, and the exploit has been publicly disclosed.

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating scheduled tasks via the admin UI. An account with permission to create at least one task type could supply a crafted value that overwrote the configuration of an unrelated existing task instead of creating a new one.

Nexus Repository 3 is vulnerable to stored cross-site scripting (XSS). A user with nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script, which would later execute in another user's browser when viewing system health-check status. Fixed in version 3.95.0.

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

Frappe is a full-stack web application framework. Prior to versions 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

Smarty is a template engine for PHP. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to read arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents. Fixed in version 5.8.4.

Smarty is a template engine for PHP. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a trusted directory could point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. Fixed in versions 5.8.2 and 4.5.7.

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an unfiltered_html capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. Patched in version 2.6.1.

A vulnerability was found in SourceCodester Photo Share Website 1.0 in an unknown function of the file /social/ajax.php?action=save_upload. Manipulation of the img[]/imgName[] arguments leads to unrestricted upload. The attack can be launched remotely and the exploit has been publicly disclosed.

A lack of tenant separation in SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.

A heap-based buffer overflow vulnerability was found in MZ Automation libiec61850 up to 1.6.1 in the function SVReceiver_stopThreadless of src/sampled_values/sv_subscriber.c. The attack must be initiated locally and the exploit is public. Version 1.6.2 mitigates the issue.

OPeNDAP Hyrax is vulnerable to SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.

Dell OpenManage Server Administrator versions prior to 11.1.0.2 contain a Relative Path Traversal vulnerability. A low privileged attacker with remote access could exploit this to gain filesystem access.

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability due to the absence of WordPress's esc_url() escaping function on the $url variable before it is rendered into HTML. This variable is constructed from home_url() and concatenated into an href attribute on every singular post or page.

The TeamDavid Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered.

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the payload to execute in the victim’s browser when they click the link. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.