CVE Vulnerability Catalog

GIS Informatics GisLab Laboratory Management System versions from 1.4.03 before 1.5 contain an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. The flaw allows injection of malicious SQL code.

Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. The vendor was contacted early about this disclosure but did not respond in any way.

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.

Some HikCentral Access Control versions contain an authorization flaw. An authenticated low-privilege user can invoke API interfaces that their role is not authorized to access.

Some Hikvision intercom products utilize an immutable factory value obtainable from local network or physical interaction, which may allow attackers to forge a legitimate main card and gain permission to issue cards.

Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size declarations to read past allocated buffer boundaries.

The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 contains a path traversal vulnerability in the gallery image management controller. The controller tasks lacked directory confinement checks.

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db endpoint misclassifies nested arrays when they contain an unrecognized stage key (e.g., $_internalInhibitOptimization), allowing a non-admin user to inject forbidden operators like $lookup and perform cross-collection joins into restricted collections.

The Joomla T4 Page Builder extension (joomlart.com) in versions below 2.3.0 exposes a front-end JSON editor endpoint with a 'contact' action that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and mail is sent from the site's configured sender identity.

The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 relied on client-submitted hidden fields for recipient routing in booking inquiries. This allowed email destination manipulation and form tampering.

Joomla Extension SP Property versions below 4.1.4 contain an unauthenticated stored cross-site scripting (XSS) vulnerability due to unescaped output in views and admin lists. Multiple template files rendered attributes and text values directly into HTML without contextual escaping.

The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 contains missing access control in gallery image management. The controller tasks lacked authorization checks and CSRF token validation, allowing users to invoke file removal actions with arbitrary path strings or upload unverified file types.

Joomla Extension SP Property versions below 4.1.4 lack CSRF token verification in the property booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints. These endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.

The SP Property extension for Joomla (joomshaper.com) in versions below 4.1.4 contains an unauthenticated SQL Injection vulnerability. The property search and listing query builders (zipcode, sorting, price_range_dropdown, psize_range_dropdown) concatenate raw request parameters directly into SQL strings without quoting or type casting. A remote unauthenticated attacker can perform boolean-based or time-based blind SQL injection to extract sensitive data from the database.

The Redux Framework plugin for WordPress in versions up to and including 4.5.13.1 is vulnerable to stored cross-site scripting via the Slider field in User Profile settings. This is due to insufficient input sanitization in the user_meta_save() function and improper output escaping in the Redux_Slider::render() method. An authenticated attacker with Subscriber-level access or above can inject arbitrary scripts into their profile that execute when an Administrator views the attacker's profile page.