CVE Vulnerability Catalog

Improper authorization in Apache ActiveMQ allows an authenticated low-privilege user to bypass per-destination write ACLs by sending to a temporary composite destination, bypassing the authorization check.

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions from graph data are interpolated directly into HTML, allowing an attacker to inject malicious JavaScript.

Lookyloo does not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker can submit a crafted archive that expands to a very large size, exhausting memory and causing denial of service.

In the Joomla extension Joomdle versions prior to 3.1.1, a Reflected XSS vulnerability was found. The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.

When switching from Grant Table v2 to v1 in Xen, code holding the grant table lock but temporarily dropping and re-acquiring it wrongly assumes that table properties won't change during the window without the lock. This leads to issues with status frames that disappear when switching from v2 to v1.

When switching from Grant Table v1 to v2 in Xen, code holding the grant table lock but temporarily dropping and re-acquiring it wrongly assumes that table properties won't change during the window without the lock. This leads to a reduction in the number of valid grant references.

A guest with Populated on Demand (PoD) enabled may attempt to reclaim pages that are not regular guest RAM. This can cause corruption of memory management state in Xen.

Accessing vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleanup of that configuration information is not synchronized with its retrieval by a device model controlling the guest.

In the libfsimage iso9660 driver, the Rock Ridge CE record processing assumes a good size and offset without validation. An attacker can control these values on disk.

In the libfsimage iso9660 driver, the Rock Ridge NM record processing assumes a good entry length without validation. An attacker can control this value on disk.

In the libfsimage iso9660 driver, the Rock Ridge extension loop assumes a good inner record length without validation. An attacker can control this value on disk.

In the libfsimage iso9660 driver, the calculation of the System Use area may underflow. An attacker can control on-disk values leading to this error.

In the libfsimage iso9660 driver, the directory loop assumes a good record length without validation. An attacker can control this value on disk.

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. Attackers with server file system access can retrieve them, potentially leading to privilege escalation. The vendor assessed risk as very low and will not fix. Version 6.7 tested, but all versions are vulnerable.

In Dogtag PKI's ACME responder, web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. Appending a trailing slash bypasses Tomcat authentication while RESTEasy still routes the request, allowing unauthorized toggling of ACME service state including persistent denial of service.

In GoClaw up to version 3.13.2, the function ExecTool.Execute in file goclaw/internal/http/tools_invoke.go, component jq Handler, is vulnerable to information disclosure via manipulation. The attack can be launched remotely. Exploit has been published. The patch is called 1230.

The Cozy Blocks plugin for WordPress up to version 2.2.11 is vulnerable to Stored Cross-Site Scripting via the 'postMeta.font.size' block attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute when a user visits the affected page.

The Paid Memberships Pro plugin for WordPress up to version 3.8.1 is vulnerable to Stored Cross-Site Scripting via the Readonly User Field in the [pmpro_member_profile_edit] shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary scripts that execute when a user visits the affected page.

The cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. (version used at Resurrection Fest 2025) employs MIFARE Classic technology (FM11RF08S) with an insecure cryptographic algorithm. The weakness allows an attacker to retrieve access keys via Backdoored Nested Attack, read the entire wristband contents, and clone credentials onto a compatible rewritable card.

The Chatbot plugin for WordPress up to version 8.5.9 is vulnerable to Missing Authorization in the wpcs_send_email() AJAX handler. The function is registered for both authenticated and unauthenticated users without nonce verification, capability check, or rate limiting, and forwards attacker-controlled recipient, subject, and body directly to wp_mail(). This allows unauthenticated attackers to send arbitrary emails from the site's domain.