CVE Vulnerability Catalog

In ProjectWorlds Advanced Library Management System 1.0, the mysqli_query function in returned_book_search.php (Search Form component) does not protect the datefrom/dateto arguments, allowing SQL injection. The attack can be executed remotely, and a public exploit is available that could be used for attacks.

In ProjectWorlds Advanced Library Management System 1.0, manipulating the firstname/middlename/lastname/address/branch/type arguments in edit_member.php leads to SQL injection. The vulnerability is remotely exploitable and a public exploit is available.

The DigitalME eRoom plugin (eroom-zoom-meetings-webinar) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects eRoom versions up to and including 1.7.1.

Nuxt framework versions 3.13.0 through 4.6.2 contain a vulnerability where the server-island renderer serializes raw useHeadSafe entry input without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application passing attacker-controlled data to useHeadSafe in a .server.vue component or one rendered through NuxtIsland can render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. The issue is fixed in version 4.6.2.

In Nuxt prior to 4.6.2, pages are resolved case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively. A request differing only by letter case can render without the intended server rule, skipping redirects, headers, proxy, ssr: false, and noScripts. Applications setting router.options.sensitive: true in nuxt.config are not affected.

Nuxt, an open-source web development framework for Vue.js, from 3.11.0 until 3.21.4 and 4.4.4 compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters. This allows a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path, so appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data.

In stream-json from 2.0.0 until 3.7.0, FlexAssembler joins the full key stack on every container start, causing quadratic CPU consumption for deeply nested documents. The join occurs before rule matching, so the attacker need not know the schema; only consumers using string or regex path filters are affected.

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values, allowing injection of arbitrary HTML and JavaScript. The issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components, and can produce reflected or stored cross-site scripting under the application's origin.

H5P through 1.17.9 contains an Authorization Bypass Through User-Controlled Key vulnerability that allows exploiting incorrectly configured access control security levels.

In Apache Pulsar, when package management is enabled, the Functions worker authorized requests to register or update functions, sources and sinks only against the namespace where the component was being registered, without checking whether the requesting user could access the package referenced by the package URL. The package was retrieved from the broker using the worker's own credentials, so the Packages Management Service permission check applied to the worker's identity rather than the requesting user's. An authenticated user could thereby obtain the contents of a package stored in another tenant's namespace without having the required permissions.

The Apache Pulsar broker did not check authorization for the GetSchema and GetOrCreateSchema binary protocol commands, verifying only that the client was authenticated. An authenticated client without permissions on the target topic could read a schema from another namespace or tenant, or register a new schema version, potentially causing schema incompatibility errors for legitimate producers and consumers. The issue affects deployments with authorization enabled in versions 2.2.0–4.0.13, 4.1.0–4.1.3, and 4.2.0–4.2.4.

Cisco Expressway Series contains multiple internally discovered vulnerabilities related to insecure temporary files (CWE-377), addressed in software hardening releases. The vulnerabilities are grouped under this CVE identifier.

Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The issue is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory.

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This is due to improper input validation for specific HTTP requests; an attacker could send a crafted HTTP request to access parts of the network beyond their intended scope.

A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client is due to insufficient validation of user-supplied input. An authenticated local attacker can send a series of crafted IPC messages to a local socket, allowing limited file write operations with SYSTEM or root privileges. On macOS and Linux, the flaw can be used to obtain full root privileges.

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine related to handling GTP extension headers in the codec. An unauthenticated remote attacker can send a crafted, fragmented UDP datagram, causing an infinite loop and a denial of service condition.

A vulnerability in Cisco Expressway Series is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An unauthenticated remote attacker could submit a crafted URL request to access sensitive information they are not authorized to access. This affects Expressway-C and Expressway-E devices.

Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device.

Multiple Cisco products are affected by a vulnerability in the GRE tunnel decapsulation feature of the Snort 3 Detection Engine. An unauthenticated remote attacker can send a crafted GRE payload, causing an unexpected restart of the engine and leading to a bypass or denial of service condition.

A vulnerability in the Snort 3 VBA Decompression Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS). The flaw is due to improper range checking when decompressing user-controlled VBA data. Sending crafted VBA data can cause a stack overflow and DoS condition.