CVE Vulnerability Catalog

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization rendering. Attackers can craft table rows with payloads such as unquoted attribute injections containing event handler attributes that bypass RFC 4180 quoting, since angle brackets and event handler attributes are never escaped before assignment, causing malicious scripts to execute in the embedding page's origin.

A vulnerability in core-php-admin-panel up to a specific commit affects unknown processing in the file customers.php. Manipulating the filter_col argument leads to SQL injection. The attack can be launched remotely, and the exploit has been published.

The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint (default: 1000 characters) defined in StreamReadConstraints. An attacker can submit a number token of arbitrary length, leading to excessive memory allocation and potential CPU exhaustion, resulting in a denial of service (DoS). The issue affects jackson-core versions 2.15.0–2.18.5 and 2.19.0–2.21.0, as well as tools.jackson.core 3.0.0–3.0.x.

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in stunnel 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., "::ffff:127.0.0.1") or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the stunnel host that should not be network-reachable.

Pega Platform versions 23.1.0 through 25.1.3 are affected by a Stored Cross-site Scripting (XSS) vulnerability in a user interface component. It requires a high privileged user with a developer role.

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.

A vulnerability in the Oidcc.Plug.Authorize module of the oidcc_plug library causes the User-Agent session binding to be ineffective. Due to incorrect header matching (case sensitivity), nil is always stored in the session, and the callback-side check is skipped. As a result, the defense-in-depth control fails silently, even when check_useragent is enabled.

The Samsung Open Source rlottie library has a vulnerability in improperly controlled sequential memory allocation, allowing Exponential Data Expansion.

A vulnerability in HUMANIST Digital Human Resources by Bilin Software allows insufficient session expiration, enabling session ID reuse (Session Replay). The issue affects versions from 26.0 before 26.1.

HUMANIST Digital Human Resources from 26.0 before 26.1 has an open redirect vulnerability that allows phishing.

HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc. has an observable response discrepancy vulnerability that allows Account Footprinting. The issue affects versions from 26.0 before 26.1.

A Path Traversal vulnerability was found in HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc., allowing access to files outside the restricted directory. The issue affects versions from 26.0 before 26.1.

Improper neutralization of input during web page generation (cross-site scripting) vulnerability in HUMANIST Digital Human Resources allows Stored XSS. Affects versions from 26.0 before 26.1.

The Chat Widget WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded, so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting.

The REST API Log WordPress plugin before version 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester. This allows unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user. This allows users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.

The Simple Google Calendar Outlook Events Widget WordPress plugin before version 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function. This allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.