CVE Vulnerability Catalog

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction(), allowing an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access.

Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

A type confusion vulnerability in SuiteCRM prior to version 7.12.6 occurs during processing of the 'module' parameter in the 'deleteAttachment' functionality. A remote unauthenticated attacker can alter database objects, including changing the administrator's email address.

An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots.

In Devolutions Server, an improper access control issue allows a View-only user to retrieve sensitive third-level nested fields, such as password list custom values, resulting in password disclosure. Affects versions 2025.3.2.0 through 2025.3.5.0 and 2025.2.15.0 and earlier.

The Contest Gallery plugin by ContestGallery developer contains a Cross-Site Request Forgery vulnerability in versions from n/a through 28.0.0. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.

The Effect Maker plugin by anibalwainstein contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Effect Maker from n/a through <= 1.2.1.

The UDesign Core plugin by AndonDesign contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects UDesign Core from n/a through <= 4.14.1.

The Cost Calculator Builder plugin (Stylemix) up to version 3.5.32 has a Missing Authorization vulnerability. This means unauthorized users may gain access to functions that should be protected.

The TheGem Demo Import (for WPBakery) plugin has a missing authorization vulnerability, allowing unauthorized users to access demo import functionality. Affects versions up to and including 5.10.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements. This issue affects TheGem Theme Elements (for WPBakery) from n/a through <= 5.10.5.1.

Insertion of Sensitive Information Into Sent Data vulnerability in Sovlix MeetingHub. Allows retrieving embedded sensitive data. Affects versions up to and including 1.23.9.

Missing Authorization vulnerability in Togo by uxper. Affects versions before 1.0.4.

The Togo plugin (versions < 1.0.4) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may lead to unauthorized access to functions or data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through < 3.9.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.

Missing Authorization vulnerability in ThemeNectar Salient. This issue affects Salient from n/a through 17.4.0.

Missing Authorization vulnerability in hogash KALLYAS kallyas. This issue affects KALLYAS from n/a through <= 4.22.0.