CVE Vulnerability Catalog

Reflected Cross-Site Scripting (XSS) vulnerability in WebWork allows remote attackers to execute arbitrary code through the 'q' and 'engine' request parameters in /search.

A vulnerability in Portabilis i-Educar up to 2.10 affects an unknown function in /module/Api/turma. Manipulation leads to improper authorization. Remote attack possible, exploit publicly disclosed.

A vulnerability was found in Portabilis i-Educar up to 2.10, involving improper access controls in the file /matricula/[ID_STUDENT]/enturmar/. The attack can be initiated remotely, and the exploit has been made public.

In the Linux kernel, the crypto/ccp driver (sev-dev.c) has a bug where an uninitialized error pointer is dereferenced in __sev_platform_init_locked(). This can lead to unpredictable system behavior.

A vulnerability was discovered in itsourcecode POS Point of Sale System 1.0 involving cross-site scripting in the file /inventory/main/vendors/datatables/unit_testing/templates/empty_table.php. Manipulation of the scripts argument allows remote attack execution. The exploit is publicly available and may be used.

A vulnerability was discovered in itsourcecode POS Point of Sale System 1.0 involving cross-site scripting in the file /inventory/main/vendors/datatables/unit_testing/templates/deferred_table.php. Manipulation of the scripts argument allows remote attack execution. The exploit is publicly available and may be used.

The Optio Dentistry plugin for WordPress has a Stored XSS vulnerability via the 'optio-lightbox' shortcode in all versions up to and including 2.2, due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts.

fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks through TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When establishing a TLS session, if one side shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. The CPU is consumed until the overall connection is closed, potentially shutting down a fs2-io powered server. This issue is fixed in versions 2.5.13, 3.12.1, and 3.13.0-M7.

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. Affects versions 6.0 before 6.0.25, 7.0 before 7.0.22, and 8.0 before 8.0.12.

A use-after-free vulnerability was found in the Linux kernel's QAT (QuickAssist Technology) drivers. Repeated loading/unloading of a device-specific driver (e.g., qat_4xxx) in a tight loop can cause a crash when a power management interrupt fires just before driver unload, leaving a pending work item in the shared `qat_misc_wq` queue. Executing that item after driver removal dereferences freed memory, leading to a kernel panic.

In the Linux kernel, the venus driver lacks protection against spurious interrupts during probe. Registering the IRQ before handler initialization can lead to a NULL dereference during system boot on Rb3Gen2.

In the Linux kernel, Hygon processors lacked the resctrl_cpu_detect() call in BSP initialization, causing a division by zero fault during boot. The issue appeared after the function was moved to vendor-specific code.

In the Linux kernel, a dst refcount leak was discovered for loopback packets in the netfilter nf_reject module. The issue occurs when nf_reject_fill_skb_dst attempts to replace the dst entry in a packet that already has one (e.g., loopback traffic), triggering a WARN() and potential memory leak.

Portabilis i-Educar up to 2.10 has an improper access control vulnerability in /exportacao-para-o-seb. Manipulation results in unauthorized access.

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Manipulation of the ref_cod_aluno argument in educar_historico_escolar_lst.php leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed. Upgrading to version 2.12 resolves the issue.

Podatność CVE-2025-8695 dotyczy serwera NetGIS, gdzie niewłaściwe neutralizowanie danych wejściowych podczas generowania stron internetowych prowadzi do możliwości ataków typu Cross-site Scripting (XSS). Problem ten dotyczy wersji NetGIS Server od 5.2.4 do 22.08.2025.

The StoryMap plugin (wp-storymap) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 2.1.

Stored XSS vulnerability in Pushe Web Push Notification plugin up to version 0.5.0. Improper input neutralization during web page generation allows persistent injection of malicious scripts.

Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation. This issue affects Media Author: from n/a through <= 1.0.4.

The WordPress plugin Custom Team Manager (versions up to 2.4.2) has a Stored XSS vulnerability due to improper input neutralization during web page generation.