CVE Vulnerability Catalog

In the Linux kernel, the ath12k_service_ready_ext_event() function in the ath12k Wi-Fi driver has a memory leak. On failure, svc_rdy_ext.mac_phy_caps is not freed, causing a memory leak detected by kmemleak.

W podatności CVE-2025-9031 występuje problem z różnicą czasową w DivvyDrive Web, który umożliwia przeprowadzanie wyszukiwań międzydomenowych. Dotyczy to wersji od 4.8.2.2 do przed 4.8.2.15.

The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.

Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB from 1.0.0 before 2.0.5. Users are recommended to upgrade to version 2.0.5, which fixes the issue.

A reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.112 and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92. A remote authenticated attacker can inject JavaScript via the _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsPortlet_productTypeName parameter. The malicious payload is reflected and executed in the user's browser.

DNN (formerly DotNetNuke), an open-source web content management platform (CMS) in the Microsoft ecosystem, prior to version 10.1.0 allowed users to inject JavaScript code in the Biography field, even if that field is not rich-text. The injected code would run in the context of the website for any user viewing the profile, including administrators and/or superusers. This issue has been patched in version 10.1.0.

Cross-site scripting (XSS) vulnerability in YzmCMS through version 7.3, located in the referer header on the registration page. It allows an attacker to inject malicious script into the victim's browser.

W podatności CVE-2025-9342 występuje obejście autoryzacji poprzez klucz kontrolowany przez użytkownika w aplikacji AHE Mobile firmy Anadolu Hayat Emeklilik Inc., co umożliwia nadużycie uprawnień. Problem dotyczy wersji AHE Mobile od 1.9.7 do przed 1.9.9.

A vulnerability in Portabilis i-Educar up to 2.10 affects unknown code in the file /module/ComponenteCurricular/edit. Manipulation of the argument ID causes SQL injection. The attack can be carried out remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in SQL injection. The attack can be executed remotely. The exploit has been made public and could be used.

A SQL injection vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0 in the file /admin/print-payment.php. Manipulation of the argument sql111 allows remote attack initiation. The exploit has been made public and could be exploited.

A SQL injection vulnerability was found in SourceCodester Pet Grooming Management Software 1.0 in the file /admin/inv-print.php. Manipulation of the argument ID allows remote attack. The exploit has been released to the public and may be exploited.

The Request a Quote plugin for WordPress (from emarket-design) contains a Stored XSS vulnerability in versions up to and including 2.5.0. Improper neutralization of input during web page generation allows persistent script injection.

A vulnerability was detected in the fuyang_lipengjun platform 1.0 in the UserCouponController function of /usercoupon/queryAll. Manipulation leads to improper authorization, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.

The Cozy Blocks plugin for CozyThemes has a basic XSS vulnerability due to improper neutralization of script-related HTML tags. This affects versions up to and including 2.1.29.

The Product Catalog Simple plugin by impleCode has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.8.2.

The MaxiBlocks plugin (versions up to and including 2.1.3) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This may allow unauthorized access to functions or data.

Stored XSS vulnerability in IP Based Login plugin (up to 2.4.3) due to improper input neutralization during web page generation. Allows an attacker to inject a persistent script that executes in the victim's browser.

The Last Updated Shortcode plugin by Luke Mlsna has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.0.1.

Stored XSS vulnerability in Form Generator for WordPress plugin (up to 1.52) due to improper input neutralization. Allows persistent script injection that executes in the user's browser.