CVE Vulnerability Catalog

IsMyGym by Zuinq Studio contains a Reflected Cross-Site Scripting (XSS) vulnerability in the reservation endpoint, where the 'ret' parameter is reflected in the HTTP response without proper sanitization. Successful exploitation could allow an attacker to inject arbitrary JavaScript executed in the victim's browser context.

In PGYER codefever up to 0c35e60f006f9d558cc33a159baf110659351990, the _detail function in application/controllers/doc.php (URI Sanitizer component) allows path traversal via manipulation of the uri_string argument. The attack can be carried out remotely and the exploit has been publicly disclosed. The patch identifier is e4433eee96883a222403854e8ac38b3146774a07.

In rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d, the verifyiprange function in lib/Flux/PaymentNotifyRequest.php (PayPal IPN Handler component) allows an origin validation error via manipulation of the X-Real-IP argument. The attack can be carried out remotely and the exploit is publicly available. The vendor was contacted but did not respond.

The WP Discussion Board WordPress plugin contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control levels. The issue affects versions up to and including 2.6.0.

The Better Post & Filter Widgets for Elementor plugin (up to version 1.9.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthenticated users to perform actions they should not have access to.

The Booking and Rental Manager plugin (up to version 2.8.2) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This may enable unauthenticated users to access restricted functionality.

The Image Gallery block plugin (up to version 2.4.1) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows an attacker to store malicious script that executes in a user's browser.

The Gutenberg Blocks by Kadence Blocks plugin (up to version 3.8.0.1) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. An attacker can store malicious script that executes in a user's browser.

The Ad Inserter plugin (up to version 2.8.18) has a Reflected XSS vulnerability due to improper neutralization of input during web page generation. This allows an attacker to reflect malicious script in the server response, which executes in the victim's browser.

The Royal Elementor Addons plugin (up to version 1.7.1069) contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. An attacker can exploit client-side DOM manipulation to execute malicious script.

In BRAIN2 versions up to and including 3.09, under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account for the BRAIN2 MainService is specified during the installation wizard. The setup log file is stored in the temporary directory of the installing administrator and is generally accessible only to users with administrative privileges.

The Bopo – WooCommerce Product Bundle Builder plugin (up to version 1.2.3) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This may enable unauthenticated users to access restricted functionality.

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before rendering in the browser. Exploitation could allow a remote attacker to execute arbitrary JavaScript code in the browser of a victim who interacts with the crafted content.

Expression Language Injection vulnerability in the Apache Camel AWS2-s3 component (versions 4.8.0–4.18.4, 4.19.0–4.22.1). The S3 object name taken from the CamelAwsS3Key header is passed to the Simple language and evaluated as an expression, allowing anyone able to choose an object name in a consumed bucket to have arbitrary Simple expressions evaluated in the Camel process.

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. When token introspection is enabled (useTokenIntrospection=true), introspection results are cached by default and cache entries are not bounded by the token's exp claim. As a result, an expired token can still be accepted for up to introspectionCacheTtl (default 60 seconds) after its expiration.

A path traversal vulnerability in the Apache Camel Docling component allows the conversion output file to be written to any directory writable by the Camel process. The CamelDoclingOutputFilePath header value is passed without normalization or confinement to a base directory, letting an attacker influence the output location.

A path traversal vulnerability in the Apache Camel Docling component allows an absolute path supplied in the CamelDoclingCustomArguments header to bypass the validatePathSafety check, which only rejects relative traversal sequences such as ../. As a result, a party able to control these arguments can point the docling process at any directory accessible to the Camel process, outside the intended working directory. The issue affects versions 4.15.0–4.18.4 and 4.19.0–4.22.1 and is fixed in 4.23.0, 4.22.2, and 4.18.5.

SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing; if another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.

SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC_MAXFMMU entries. A device presenting more than EC_MAXFMMU configuration blocks can force writes beyond the array boundary, corrupting adjacent memory structures and potentially disrupting subsequent operations.

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.