CVE Vulnerability Catalog

A vulnerability in DBD::Pg version 3.21.0 for Perl: heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, but for special literals (NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity) it emits the literal surrounded by quotes plus NULL, causing an overflow of 2 bytes. This can be reached by the $dbh->quote method, e.g., $dbh->quote("Infinity", DBI::SQL_NUMERIC). This regression was introduced in 3.21.0 by the quote.c rewrite.

A vulnerability in Dromara UJCMS up to 10.1.3 in the update function of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the web-file-template Endpoint component. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.

A vulnerability in Apache::AppSamurai::Util versions through 1.01 for Perl: predictable session authentication keys generated from the clock and process id in CreateSessionAuthKey. The function runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running digest, and the process id. The key is returned to the browser as the session cookie and combined with the server key. An attacker who knows the second of session creation and the PID can enumerate candidate keys and recover the victim's cookie, bypassing authentication.

A vulnerability in Reverse::Proxy versions before 0.04 for Perl: HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. PSGI hands PATH_INFO percent-decoded, so a %XX sequence becomes a raw byte. The proxy appends that byte string to the upstream base URL, and for an Upgrade tunnel writes it into a request line it serializes itself, re-encoding nothing. A path containing %0d%0a arrives at the upstream as a CRLF that ends the request line, and a decoded space, '?' or '#' truncates it the same way. Everything the client writes after the CRLF is read by the upstream as a second request.

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() calls _populate_selectedcontent(), which recursively traverses the DOM tree without a depth bound. An attacker can supply deeply nested elements (e.g., ~1000 nested <div> tags) to exceed CPython's recursion limit and trigger an unhandled RecursionError.

justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation XSS (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() with a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out and inject arbitrary HTML. The default sanitization policy is not affected because it drops the contents of style and script.

justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting to Markdown. Characters like < and > are preserved, allowing raw HTML injection into Markdown output, bypassing sanitization and potentially leading to XSS.

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to XSS. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path.

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.

justhtml before version 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.

justhtml before version 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG <foreignObject>, MathML <annotation-xml encoding="text/html">) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter="url(...)" and preserved <style> could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.

justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as <style>). Specially crafted input can sanitize into markup that appears safe but becomes unsafe when re-parsed by a browser or another HTML parser, allowing markup injection. The default safe configuration (sanitize=True) is not affected. Fixed in 1.14.0.

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers, HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. An attacker can bypass sanitization to inject active HTML and JavaScript, e.g., via encoded javascript: URLs, backslash-based relative URLs, markup-breaking names, raw </textarea> reintroduction, or preserved <style>/<meta http-equiv=refresh>/<base href> tags.

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings, run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. These are availability-only concerns and do not allow script execution, data disclosure, or sanitizer bypass.

A privilege escalation vulnerability in the StackGres operator allows a low-privileged tenant who owns a database to gain administrator privileges.

A vulnerability in SourceCodester Class and Exam Timetabling System 1.0 in the file /admin/edit_user_account.php (User Account Update component) allows manipulation of the id/username argument, leading to improper authorization. The attack may be launched remotely.

A vulnerability in itsourcecode Hospital Management System Project in PHP 1.0 in the file /viewservicetype.php allows manipulation of the delid argument, causing SQL injection. The attack may be initiated remotely.

GitLab CE/EE versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a path traversal vulnerability in the package registry that under certain conditions could allow an authenticated user to achieve remote code execution.

The Brave Popup Builder plugin up to version 0.8.5 has a broken access control issue. Any logged-in user, even Subscriber or WooCommerce Customer, can read popup content they shouldn't have access to by passing a post ID in the URL.