CVE Vulnerability Catalog

A vulnerability in Apache Wicket affects the FileUploadToResourceField component, whose Ajax callback reads the filesInfo request parameter without binding it to an actual upload. The UploadInfo#get() method allocates a byte array based on the client-supplied size, allowing a single request to exhaust the JVM heap, while negative values trigger a NegativeArraySizeException.

A vulnerability in Apache Wicket affects the JavaScriptUtils#escapeQuotes() method, which fails to escape the backslash character before quotes. A value containing a backslash immediately before a quote results in the quote being left unescaped, closing the JavaScript string literal and allowing JavaScript injection. The issue occurs when an application uses this method to place attacker-influenced data inside a JavaScript string literal, including via the AjaxEditableLabel component.

Cross-site scripting (XSS) vulnerability in the SmartLinkLabel and SmartLinkMultiLineLabel components of Apache Wicket. These components turn URLs found in text into hyperlinks and accept any URL scheme, including script-executing schemes such as javascript:. Escaping the model value does not help because the payload ends up in the href attribute rather than in element text.

A cross-site scripting (XSS) vulnerability in Apache Wicket affects the AjaxNewWindowNotifyingBehavior, which stores the client-supplied window.name value in the page's serialized state. That value is later substituted without escaping into a single-quoted JavaScript string literal in the Ajax call precondition, allowing arbitrary script execution in the application's origin on every render of the page instance. Only applications that explicitly add this behavior to a component are affected.

Apache Wicket writes texts from resource bundles (labels, CSS class names) into generated JavaScript and markup without context-appropriate escaping. A text containing a quote can terminate the literal or attribute and be parsed as script or markup in the application's origin. Affected components include MultiFileUploadField, Form, UploadProgressBar, FilterForm and TrapFocusBehavior in versions 8.0.0–8.19.0, 9.0.0–9.24.0 and 10.0.0–10.11.0.

Session fixation in Apache Wicket affects the AuthenticatedWebSession class and its signIn(String, String) method. The session id is renewed only on the first sign-in transition and not when an already signed-in session authenticates again, even though the method returns true in both cases. Exploitation requires an attacker to plant a chosen session id in the victim's browser, e.g. through control of a host under the same registrable domain or a container configured to carry the session id in the URL.

A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P devices (version ESW_1.0(1)B1P48) in an unknown function of httpupg.cgi, part of the local firmware upgrade interface. The manipulation leads to a buffer overflow. The attack can be initiated remotely and the exploit is publicly available.

The WordPress File Upload plugin (Nickboss) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 5.2.1.

A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2 in the function sub_23908 of the shield.sys library, part of the Kernel Driver component. The manipulation leads to memory corruption. The attack can only be performed locally and the exploit is publicly available.

A weakness has been identified in Presenton up to 0.9.11-beta in some unknown functionality of the API component, causing missing authentication. The attack can be initiated remotely, and the exploit has been made public. Upgrading to version 0.9.12-beta resolves the issue.

An uncontrolled recursion vulnerability exists in the Apache Thrift Java bindings. The issue affects Apache Thrift versions before 0.24.0. It is fixed in version 0.24.0.

CVE-2026-118147 is an improper certificate validation vulnerability in Visual Studio. An unauthorized attacker can exploit this flaw to perform spoofing over a network.

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.

Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances. An unauthenticated remote attacker can crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition name field.

The NextGEN Gallery plugin for WordPress (up to and including 4.4.1) is vulnerable to Remote Code Execution via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model, missing realpath containment in path construction, and a bypassable signature check on the public image delivery route. An authenticated attacker with custom-level access and above can execute code on the server.

A flaw was found in json-glib where the JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

The Debug Log Manager plugin for WordPress (up to and including 2.5.2) is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that will execute when a user accesses an injected page. This requires debug logging enabled with JS error logging active and the attacker obtaining the publicly emitted dlmVars.jsErrorLogging nonce.