CVE Vulnerability Catalog

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the template name and is rendered into the DOM without proper sanitization, causing the injected script to execute each time the affected PDF is loaded.

Versions of the fastapi-sso package before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to improper validation of the OAuth state parameter during the authentication callback. The get_login_url method allows state generation but does not persist or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.

A security flaw has been discovered in JeecgBoot up to 3.9.0. It affects an unknown function in the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java of the Multi-Tenant Management Module. Manipulation of the ID argument results in improper authentication. The attack can be initiated remotely, and the exploit has been publicly released. The patch is named e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2/67795493bdc579e489d3ab12e52a1793c4f8a0ee.

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.

An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining access to the agents' knowledge and the ability to trigger their intents, by manipulating initialization parameters or crafting specific API requests. All versions after August 20th, 2025 have been updated to protect from this vulnerability. No user action is required for this.

Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to elevated code execution risk via the gateway backup restore functionality. An authenticated user with Gateway Administrator privileges can import a malicious gateway backup (.gwbk) file containing crafted project resources, scripts, or modules, resulting in code execution on the host system.

Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Radius Blocks: from n/a through <= 2.2.1.

Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view. The vulnerability could allow an attacker to inject malicious script that executes in the victim's browser.

W SoliClub od Utarit Informatics Services Inc. występuje luka związana z brakiem autoryzacji, która umożliwia nadużycie uprawnień. Problem dotyczy wersji przed 5.3.7.

Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. This vulnerability was fixed in Firefox for iOS 144.0.

A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network packets at two different times to inject HTML tags into asset attributes across two snapshots; exploitation requires a victim to use the Time Machine Snapshot Diff feature on those snapshots and perform specific GUI actions, enabling phishing and open redirect attacks. Full XSS exploitation is prevented by input validation and Content Security Policy, and attack complexity is high due to multiple required conditions.

The InstaWP Connect plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 0.1.1.9.

The XStore theme by 8theme is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions before 9.6.

Missing Authorization vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WebinarIgnition: from n/a through <= 4.06.04.

Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.

In the Auth0-PHP SDK, audience validation of access tokens is performed improperly. As a result, affected applications may accept ID tokens as access tokens. The issue affects Auth0-PHP versions between v8.0.0 and v8.17.0, as well as dependent SDKs (Symfony, Laravel, WordPress) relying on those versions.

A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile, which executes when the administrator views their own profile page. The vulnerability combines an Insecure Direct Object Reference (IDOR) and a Broken Access Control flaw.

HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) has improper management of Content Security Policy, which may allow the execution of malicious code in web pages.

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive payment tokens.