CVE Vulnerability Catalog

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, so an unsigned header is neither hashed into the canonical request nor rejected. Because cmd/api-router.go dispatches CopyObject on the presence of x-amz-copy-source alone, the holder of a presigned PUT URL scoped to a single object can add that header to the unmodified URL and cause a server-side copy, executed as the signer, of any object the signing key can read. A grant to write one object becomes a read of every bucket that key can reach. Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied. The minio/minio GitHub repository was archived in April 2026; pgsty/silo before 1233254 is also affected.

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject. The malformed serialized object can then cause the React Native application to crash.

A cross-site scripting (XSS) vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. The echo function in admin/fun/addLog.php does not neutralize the reason/detail arguments, allowing script injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A stored cross-site scripting (XSS) vulnerability in madpsy ka9q_ubersdr before 0.1.58 in the chat message rendering functionality. User-controlled URLs were insufficiently neutralized before being converted into HTML links, and quotation characters could break out of the href attribute and inject arbitrary HTML attributes. This allows arbitrary JavaScript execution in another user's browser without requiring a click.

A vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf affects an unknown functionality of the file example_lite.sql. Manipulation can lead to the use of default credentials. The attack can be launched remotely and the exploit has been publicly disclosed.

A cross-site request forgery (CSRF) vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf affects an unknown function. The attack can be initiated remotely and the exploit is now public.

An authorization bypass vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Manipulation of the sid/addtime/type/reason/detail/logdate arguments in user/editLog.php leads to authorization bypass. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability in Lemonldap::NG::Handler (Perl) allows bypassing locationRules by using an equivalent spelling of a path. The handler matches regular expressions against the raw REQUEST_URI, while the web server routes on the percent-decoded and normalized path, allowing bypass of deny rules, identity and group conditions, and unprotect and skip rules. Only vhosts whose default rule is more permissive than other rules are affected.

A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/fun/getStudent.php. This manipulation of the argument sid causes authorization bypass. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability in Lemonldap::NG::Portal (Perl) allows a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint issues a code even without a code_challenge, and token() admits the exchange if a challenge was stored or an authentication method was returned. An attacker can exchange an intercepted authorization code for the user's access, ID, and refresh tokens.

A vulnerability in Lemonldap::NG::Portal (Perl) allows unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. The function skips the secret comparison for a public Relying Party and returns the authentication method deduced from the request, so a request with a public client_id and an arbitrary or empty secret passes the endpoint's authentication check. An attacker can confirm the token is active and read its metadata, including scope, audience, expiry, and sub.

Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configuration conditions. Individuals with read access to system logs or support bundles can retrieve these credentials.

A vulnerability in containerd (open-source container runtime) prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1. A crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability.

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. This may lead to shell command injection.

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager with access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Folder.

This CVE was rejected because it is a duplicate of another CVE. No further vulnerability details are available.

The Perl module IO::Socket::SSL::SelfCertificate version 1.00 contains malware that executes Python code from an obfuscated URL. The generate_certificate function runs a Python script saved as a certificate file. The malicious file is located at lib/Crypt/SelfCertificate/sample/cert.pem.