CVE Vulnerability Catalog

The MasterStudy LMS plugin for WordPress versions <= 3.0.7 has a stored Cross-Site Scripting (XSS) vulnerability for contributor+ users.

A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus versions 15.1.0 to 16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link.

IBM SPSS Modeler on Windows versions 17.0, 18.0, 18.2.2, 18.3, 18.4, and 18.5 requires the end user to have access to the server SSL key, which could allow a local user to decrypt and obtain sensitive information.

Blogengine.net version 3.3.8.0 and earlier is vulnerable to Open Redirect, which may allow attackers to redirect users to malicious sites.

A cross-site scripting (XSS) vulnerability was discovered in User Registration & Login and User Management System v1.0 via the component /admin/search-result.php.

Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was found to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This issue is fixed in version 6.2.6.1-GA.

A critical vulnerability has been found in Agro-School Management System version 1.0. Manipulation of the test_id argument in the exam-delete.php file leads to SQL injection, which can be exploited remotely.

An issue was discovered in the Linux kernel through 6.1-rc8 related to the lack of checking the return value of kzalloc() in dpu_crtc_atomic_check, leading to a NULL Pointer Dereference.

Enphase Envoy version D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands.

A critical vulnerability was found in SourceCodester Online School Fees System version 1.0. The issue affects some unknown functionality of the file ajx.php in the GET Parameter Handler component, where manipulation of the argument name_startsWith leads to SQL injection.

The Flothemes Flo Forms plugin versions up to 1.0.40 contains a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of administrative users.

A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.

A vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.

Craft CMS versions up to 4.4.9 are vulnerable to HTML Injection.

The Team Heateor Super Socializer plugin versions up to 7.13.52 contains a stored Cross-Site Scripting (XSS) vulnerability for users with contributor permissions and above.

The Extra User Details plugin by Vadym K. in versions up to 0.5 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).

The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.1. This is due to missing nonce validation in the ~/admin/views/admin.php file, allowing unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request.

Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of a specified file path on the Jenkins controller file system.

A flaw was found in the IPv6 module of the Linux kernel, involving inconsistent use of arg.result in fib6_rule_lookup. This may lead to a kernel panic in fib6_rule_suppress.

PyBB is an open source bulletin board software that contains a vulnerability allowing users to submit any type of HTML tag, which could lead to the execution of malicious JavaScript code on the client side. The issue has been patched in version 0.1.1, and users are advised to upgrade.