CVE Vulnerability Catalog

Revive Adserver 5.5.2 and 6.0.1 and earlier versions have improper input neutralization, allowing manager accounts to craft XSS attacks against their own advertiser users.

Debug information disclosure in the SQL error message in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.

Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts.

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions cause non-admin users to have access to the contact name and email address of other users on the system.

Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack.

Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user.

Improper Neutralization of Input in Revive Adserver 5.5.2, 6.0.1 and earlier versions causes a potential reflected XSS attack. The vulnerability allows injection of malicious JavaScript that is reflected back to the victim's browser.

An uncontrolled resource consumption vulnerability exists in userlog-index.php. An attacker with access to the admin interface can request an arbitrarily large number of items per page, potentially leading to denial of service.

eGovFrame Common Components up to version 4.3.1 has an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/insertImageCk.do endpoints. An attacker can upload arbitrary content, and the server stores the file and returns a download URL, allowing the application to be used as a file hosting service.

Podatność CVE-2025-11963 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w StarCities, co pozwala na ataki typu Reflected XSS. Problem ten występuje w wersjach przed 1.1.61.

Podatność CVE-2025-0421 dotyczy niewłaściwego ograniczenia renderowanych warstw interfejsu użytkownika lub ramek w oprogramowaniu Shopside firmy Shopside Software Technologies Inc. Problem ten występuje w wersji Shopside do 05022025, umożliwiając wykorzystanie nakładek iFrame.

The MongoDB C driver (mongoc) may read invalid memory if large options are passed to a mongoc_bulk_operation_t.

A Use After Free vulnerability has been identified in the GRUB2 bootloader's normal module. The flaw occurs because the normal_exit command is not properly unregistered when its module is unloaded. An attacker can invoke the command after module removal, causing access to freed memory.

A Use-after-Free vulnerability has been found in the GRUB2 bootloader's 'normal' command. The flaw occurs because the command is not properly unregistered when the module is unloaded, allowing an attacker to access invalid memory locations. Successful exploitation leads to system instability and a complete crash.

A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component due to improper string conversion when reading data from a USB device. A local attacker can connect a maliciously configured USB device during boot sequence, causing GRUB to crash and leading to a Denial of Service (DoS). Data corruption may also be possible, but due to exploit complexity the impact is likely limited.

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges by obtaining the external control key from the config file.

A use-after-free vulnerability has been identified in GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service.

A Use-after-Free vulnerability has been found in the GRUB2 bootloader's network module. The flaw is caused by improper unregistration of the net_set_vlan command when the module is unloaded from memory. An attacker can exploit this to cause system instability and a complete crash.

A remote command execution (RCE) vulnerability was found in H3C ERG3/ERG5, XiaoBei routers, cloud gateways, and wireless access points. Attackers can inject crafted commands via the sessionid parameter.

A stored cross-site scripting vulnerability was found in SourceCodester Student Grades Management System 1.0. The create_classroom function in /classroom.php fails to sanitize the name/description arguments, allowing script injection.